I have a few managers that wantto verify some of their employee’s are doing what they say they are doing (mainly working the hours they say they are).
I have already turned on logging the successful login events in security thru group policy but after sifting thru all the junk from the event viewer (downloaded it into a spread sheet) it doesn’t appear to be very accurate. It shows me logging in the earliest 10:30am. I start work at 8 (I’m usually here earlier then that).
The only thing I can think is that the local machine is logging users in with cached credentials and the earliest times I’m seeing are when it actually has to contact the domain controller to be authtenticated to get something off the network?
I haveb een on this since last week and I’m more then a little frustrated. Any help would be greatly appreciated.
And if there is no way to achieve this without some sort of 3rd party tool/software please let me know that as well (I figured this would be fairly easy to do with Server 2003).
Thanks in advance.