[logs] Auditing User Network Login and Logoff information.

From: Varadarajam (v.rajam@private)
Date: Sat Jul 30 2005 - 00:38:27 PDT


Hi,

I would like to know some information about this auditing logon 
events. I enabled audit account logon events in my Default Domain 
 Policy in my Domain Controller. I am getting some logs in Security 
 audit with event ID 538,540,672,673,680,517 like that. But i couldn't 
 able to find the Client Logon and Logoff information exactly. I have 
 checked lot of websites, its mentioning like 528 for Logon, 538 for 
 Logoff.  But i am not getting these events in my Security Log.  So, I couldn't able find the client user exact network logon and logoff information like, When did he logon to his computer and when did he logoff from his computer like that information i would like to know.. 

 Kindly pls help me in this with the full and clear information.

Varadarajam.P.V.
Systems Administrator
Softpro Systems Ltd.,
Plot # 12, Softpro Heights,
Software Units Layout
Madhapur, Hyderabad - 500 081.
Ph: 040- 23111793/23111806 Extn:2037
Fax# 040- 23100385



_______________________________________________
LogAnalysis mailing list
LogAnalysis@private
http://lists.shmoo.com/mailman/listinfo/loganalysis



This archive was generated by hypermail 2.1.3 : Sun Jul 31 2005 - 16:48:15 PDT