tcdrake wrote: > I want to audit when a user first logs onto their system for the day > and when they log of for the day. I have looked through my Active > Directory Security logs and notice users with multiple success logs > within seconds of each other then a log off within a minute. Event > ID's of 540 and 538. How can I narrow this down?
Are you collecting logs from the system that the user logs onto or just the domain controller? This makes a difference. Generally, I like to go to the system in question and look for something like a 528. 538s are generally considered to be untrustworthy since the client is under no obligation to log off gracefully. The absence of a 538 should not be construed as no logoff. Also, don't forget that someone can stay logged on to a terminal services session and reconnect, which is another event ID. And someone might stay logged in locally, and then lock and unlock the workstation. So, the answer is: It depends!
