logon and logoff events

Can I explain how (I think) this forum works:

You post a question
If someone knows the solution, they reply
You then test the proposed solution
if it works, you reply saying it has and give them the thumbs up.
If it doesn't, you reply saying it hasn't worked and why it hasn't, or why the solution is unsuitable.
That then allows other people to read all the responses and maybe come up with another solution.

How many times have you asked this same question, and only replied once? 6 times, in 5 days?

This one, and ...
https://www.techrepublic.com.com/5208-6230-0.html?forumID=102&threadID=247715&messageID=2382719
https://www.techrepublic.com.com/5208-6230-0.html?forumID=101&threadID=247300&messageID=2380136
https://www.techrepublic.com.com/5208-6230-0.html?forumID=101&threadID=247301&messageID=2380137
https://www.techrepublic.com.com/5208-6230-0.html?forumID=101&threadID=247302&messageID=2380184
https://www.techrepublic.com.com/5208-6230-0.html?forumID=101&threadID=247568&messageID=2381838

And posts don't get deleted automatically, so you don't have to keep reposting day after day.

Expecting to see these events in the DC log? Because you won't. Enabling the auditing policies through GPO enables the policies on the computer objects under the OU where the policy has been linked. The logon\off events are in each computers Security log. The DC should record everytime a specific account authenticates, but that isn't really the same thing.

You have a couple of choices for how to handle the logs. You can collect them with software like this:

http://www.intersectalliance.com/projects/index.html

or

http://kbase.gfi.com/showarticle.asp?id=KBID002977

Or you can use dumpel.exe if you have a Windows 2K Server Resource Kit, or you can use VBScript and WMI, or you can use Powershell to write a nifty script to parse logs.

Really you have a lot of ways to go, it just depends on either your budget or your desire to write scripts. :)

I loooooooooove writing scripts!