Server 2003 Log on event

[hotwired007]

Hi, is there a way of getting the computers/servers to log when and where accounts are logged in? if so how do i do it...

 

if not... why?

 

thanks in advance

[Windy08]

You can set up a Group Policy on your Server to use an audit log which lets you audit account logon events.

The Group Policy is in Computer Configuration->Windows Settings->Security Settings-Local Policies->Audit Policy

Don't log everything cos they can take up a fair amount of space

[browolf]

i find it more usable to log details from the login script to text files i.e. Logging Logins

[hotwired007]

i find it more usable to log details from the login script to text files i.e. Logging Logins

 

so do i just copy this:

 

for /f "tokens=1,2,3* delims=/ " %%a in ('date /t') do set date=%%a%%b%%c%%d

for /f "tokens=1,2 delims=:" %%a in ('time /t') do set time=%%a%%b

 

echo %date%,%time%,%username% >> \\server\computer$\%computername%.txt

echo %date%,%time%,%computername% >> \\server\user$\%username%.txt

 

into the logon script? (ovbiously changing the server bit to a working link?)

[browolf]

so do i just copy this:

 

for /f "tokens=1,2,3* delims=/ " %%a in ('date /t') do set date=%%a%%b%%c%%d

for /f "tokens=1,2 delims=:" %%a in ('time /t') do set time=%%a%%b

 

echo %date%,%time%,%username% >> \\server\computer$\%computername%.txt

echo %date%,%time%,%computername% >> \\server\user$\%username%.txt

 

into the logon script? (ovbiously changing the server bit to a working link?)

 

yup. & everyone needs read/write on the share tho cos its appending files under their logon. u dont have to have 2 different shares. i use logs$ with \users\ and \computers\