Sorry Kurt, didn't read past Thomas's signature. Although this tool does give quite a bit of logging in XML or CSV that you can pull from its primary focus is not what we were looking for.
-----Original Message----- From: Kurt Buff [mailto:[EMAIL PROTECTED] Sent: Thursday, February 07, 2008 11:56 PM To: NT System Admin Issues Subject: Re: software to monitor users login and logoff On 2/7/08, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > Remember that if you have multiple DC's that the last logon is > registered on the DC they authenticated to and it doesn't replicate to > other DC's. There are scripts out there that will poll all the DC's and > give you that info but you have to put it together. That's why I said: " Actually, you might want to put the Snare client on the workstations instead." That way you can capture logon events more directly. Of course, it means setting auditing for each of the workstations, but that's not terribly onerous, and the Snare client includes facilities for remote self-installation. Should be pretty painless, really. Kurt ~ Upgrade to Next Generation Antispam/Antivirus with Ninja! ~ ~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm> ~ ~ Upgrade to Next Generation Antispam/Antivirus with Ninja! ~ ~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm> ~
