Need to log user logins either with Group policy and/or Event Viewer

By Hurell.Lyons ·
I have a few managers that wantto verify some of their employee's are doing what they say they are doing (mainly working the hours they say they are).

I have already turned on logging the successful login events in security thru group policy but after sifting thru all the junk from the event viewer (downloaded it into a spread sheet) it doesn't appear to be very accurate. It shows me logging in the earliest 10:30am. I start work at 8 (I'm usually here earlier then that).

The only thing I can think is that the local machine is logging users in with cached credentials and the earliest times I'm seeing are when it actually has to contact the domain controller to be authtenticated to get something off the network?

I haveb een on this since last week and I'm more then a little frustrated. Any help would be greatly appreciated.

And if there is no way to achieve this without some sort of 3rd party tool/software please let me know that as well (I figured this would be fairly easy to do with Server 2003).

Thanks in advance.

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Answers

Collapse -

event viewer

by Hurell.Lyons In reply to Need to log user logins e ...

Anyone have any idea what I'm talking about?

Collapse -

Group Policy

You can turn off login caching with Group Policy. In Computer Configuration, Windows Settings, Security Settings, Local Policies, Security Options, Interactive logon: number of previous logons to cache. Enable this and set it to 0.
Note that you can also set a policy here to force DC authentication to unlock a workstation.

Collapse -

Thank you Thank you

by Hurell.Lyons In reply to Group Policy

Perfect....Thank you. I'll try this and see if it captures the data I need. Will forcing DC auth slow unlocking/logging into a workstation down any.....if so I'll have to leave that turned off.

Related Discussions

Related Forums