Hey Brian....
Assuming you're talking about a Windows NT or 2000 domain environment here, basically what you'd need to do is grab the Security Event Logs from one of the domain controllers, and parse that event log for event codes that pertain to account logons and logoffs. The relevant event log entries will detail the remote user and computer name that attempted the logon/off attempt.
If you're just talking about auditing one machine, rather than a domain, the same principle applies - except rather than scanning the event logs on a domain controller, you'd scan the event logs of that one machine (assuming Win NT or 2000).
You'd need to ensure that the appropriate level of auditing is enabled on the domain/machine to capture logon/off attempts (but that's easy).
The hard(er) part would be to:
a) find a tool or tag that will let you parse the event logs (may need to CFEXECUTE an external tool?)
b) if you want to capture these events real-time, you'd need to try and intercept writes to the event logs, which I'm not sure you can do. Or maybe just do aggressive repetitive parsing of the security event log.
hth,
John :)
_____________________________________________
From: [EMAIL PROTECTED]@AUS On Behalf Of "Knott, Brian" <[EMAIL PROTECTED]>
Sent: Tuesday, July 29, 2003 11:48 AM
To: CFAussie Mailing List
Subject: [cfaussie] OT Windows login
Does anyone know the best way to record people loggin on and off a windows
machine. I want a system that will record (to MS SQL), who logons on ,
when, from what machine, and when they log off. This information can then
be displayed through CF.
Brian Knott
QANTM Studio
Senior Programmer
Ph (07) 30174331
Mob 0407572127
---
You are currently subscribed to cfaussie as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
MX Downunder AsiaPac DevCon - http://mxdu.com/
is intended only for the person or entity to which it is addressed.
The message may contain confidential and/or privileged material.
Any review, retransmission, dissemination or other use of, or taking
of any action in reliance upon this information, by persons or entities
other than the intended recipient is prohibited.
e-mail and associated material from any computer.
distribute the information contained in this e-mail and any attached files,
with the permission of the sender.
:
You are currently subscribed to cfaussie as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
MX Downunder AsiaPac DevCon - http://mxdu.com/
