Secuity Event Log Scanner/Manager

[jj99]

I wondered if anyone knows of a bit of software for managing event logs especially secuirty (prefriably free). I want to be able to pick out from the logs quickly when and where a pupil logged on.

 

The problem is I have 4 DC's spread over 3 schools and when i need to find out a logon and place i have to trawl through 4 logs and usually they have been overwitten.

 

So ideally a centrally managed soloution would be great!

 

Any ideas or suggestions

[Quackers]

If you put this in a batch file and create a hidden share, then add it as a user logon script in group policy.

 

echo DATE: %date% TIME: %time% USER: %username% COMPUTER: %computername% CLIENTNAME: %clientname% LOGONSERVER: %logonserver% ACTION: Logon >> \\planet\logs$\logons.log

echo DATE: %date% TIME: %time% USER: %username% COMPUTER: %computername% CLIENTNAME: %clientname% LOGONSERVER: %logonserver% ACTION: Logon >> \\planet\logs$\computers\%computername%.log

echo DATE: %date% TIME: %time% USER: %username% COMPUTER: %computername% CLIENTNAME: %clientname% LOGONSERVER: %logonserver% ACTION: Logon >> \\planet\logs$\users\%username%.log

[jj99]

Thanks Quackers

 

Excellent works a treat, i modified and added a logoff script as well!

 

If only id thought of something so simple!

[OutToLunch]

How does something like that work if 2 users manage to log on at exactly the same time? Had thought about implementing it here but the old DOS pipe (>>) seemed like it might not be that happy with multiuser access to a log file?