>From what I remember:
You need to enable auditing of "account logon events" for the DC, which will generate audit entries for any user account authenticated against the domain controller you set it up on, and it should show what workstation (or IP) they are logging in from. For a catch-all, audit "logon events", which pretty much logs ALL logon attempts local to the machine (not just local as in Local accounts, but everything, even machine accounts) "account logon events" only grabs interactive or network logons. It's all configured in the Computer Configuration>Security Settings>Local Policies>Audit Policy portion of Group Policy.... I could be wrong though, wouldn't be the first time. cb ________________________________ From: Joe Heaton [mailto:[EMAIL PROTECTED] Sent: Friday, February 01, 2008 10:44 AM To: NT System Admin Issues Subject: Tracking user logins I would like to be able to see when User X logged into the network. I'd also like to see on Date Y, who logged into the network, and at what time. Here's what I'm looking at: I get automated router bandwidth reports from our ISP on a monthly basis. At one of our remote sites, there is a huge inbound traffic spike on a couple of weekend days. We don't work on the weekend, so I'd like to try to figure out where these spikes came from. I've looked at the Security log on my DC, but that's about as helpful as, well I'm Shook could come up with a funny line there... anyway, does the Security log track the information I'm looking for, and if so, how can I actually get to it? Joe Heaton AISA Employment Training Panel 1100 J Street, 4th Floor Sacramento, CA 95814 (916) 327-5276 [EMAIL PROTECTED] ~ Upgrade to Next Generation Antispam/Antivirus with Ninja! ~ ~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm> ~
