Thanks for the reply. Your right, I needed to add more info. My plan was to audit the DC which the users account would be authenticated with. The users PC is XP and is on the LAN. I would rather use the DC for this as that means less client roll outs on my end. Any additional help would be appreciated.
Thanks. On Jan 14, 10:45 pm, Michael Starks <[EMAIL PROTECTED]> wrote: > tcdrake wrote: > > I want to audit when a user first logs onto their system for the day > > and when they log of for the day. I have looked through my Active > > Directory Security logs and notice users with multiple success logs > > within seconds of each other then a log off within a minute. Event > > ID's of 540 and 538. How can I narrow this down? > > Are you collecting logs from the system that the user logs onto or just > the domain controller? This makes a difference. Generally, I like to > go to the system in question and look for something like a 528. > > 538s are generally considered to be untrustworthy since the client is > under no obligation to log off gracefully. The absence of a 538 should > not be construed as no logoff. > > Also, don't forget that someone can stay logged on to a terminal > services session and reconnect, which is another event ID. And someone > might stay logged in locally, and then lock and unlock the workstation. > > So, the answer is: It depends!
