Remember that if you have multiple DC's that the last logon is registered on the DC they authenticated to and it doesn't replicate to other DC's. There are scripts out there that will poll all the DC's and give you that info but you have to put it together.
My only guess would be to export it to html or csv file automatically to a share or folder that only the Exec Admin and delegated parties have access too. There is also this that I just googled. Sounds like it might fit the bill. I am sure some of the others may be able to shoot it down or give it a thumbs up. http://www.microsoft.com/technet/technetmag/issues/2005/05/UtilitySpotli ght/default.aspx http://download.microsoft.com/download/f/d/0/fd05def7-68a1-4f71-8546-25c 359cc0842/LimitLogin.exe Greg -----Original Message----- From: Kurt Buff [mailto:[EMAIL PROTECTED] Sent: Thursday, February 07, 2008 7:54 PM To: NT System Admin Issues Subject: Re: software to monitor users login and logoff On Feb 7, 2008 2:36 PM, Thomas Gonzalez <[EMAIL PROTECTED]> wrote: > I have auditing set on the dc and can see that information. but the > executive admin, wants the receptionist to see when user A logs in, (sort of > spying you know, the backdoor person) then user A logs off at schedule time. > > I'm going to keep searching so when I find something in those lines, I'll > post it back up joe. > > > Thomas I'll bet that a good syslog server could do this. Install the Snare client (http://www.intersectalliance.com/snare) on your DCs, have them send stuff to a syslog server (http://www.kiwisyslog.com) which will watch for events and can be set up to execute scripts on detection of your set of events. Actually, you might want to put the Snare client on the workstations instead. Kurt ~ Upgrade to Next Generation Antispam/Antivirus with Ninja! ~ ~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm> ~ ~ Upgrade to Next Generation Antispam/Antivirus with Ninja! ~ ~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm> ~
