Security Basics mailing list archives
Re: Windows Log
From: List Spam <listspam () gmail com>
Date: Thu, 19 Jan 2006 14:21:35 -0800
On 1/19/06, Nick Duda <nduda () vistaprint com> wrote:
To continue this topic, I'm faced with the same thing.... The problem is that with all these event id's 672, 673, 540...etc there is still no positive way to say , when a user logged on (via cntrl,alt delete) and logged off, as in shutdown or log off.
The type of logon/logoff is listed under the "Logon Type" field in the Event ID record. See the below URL for details and explanations: http://www.windowsecurity.com/articles/Logon-Types.html Sounds like you want to audit the successful login/logoff events that have a logon type of 2.
My goal, is to use syslog or some other form of monitoring to keep records of each employees logon/logoff of a PC physically on the network. I've been knee deep into all these event id's and nothing is accurate. Please help.
--------------------------------------------------------------------------- EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The Norwich University program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Tailor your education to your own professional goals with degree customizations including Emergency Management, Business Continuity Planning, Computer Emergency Response Teams, and Digital Investigations. http://www.msia.norwich.edu/secfocus ---------------------------------------------------------------------------
Current thread:
- Windows Log Rod (Jan 16)
- Re: Windows Log Ivan . (Jan 17)
- Re: Windows Log List Spam (Jan 17)
- Re: Windows Log Neil (Jan 17)
- <Possible follow-ups>
- Re: Windows Log hackman (Jan 17)
- RE: Windows Log Nick Duda (Jan 19)
- RE: Windows Log Ramsdell, Scott (Jan 20)
- RE: Windows Log dave kleiman (Jan 23)
- RE: Windows Log Nick Duda (Jan 20)
- Re: Windows Log List Spam (Jan 22)
- Re: Windows Log Ryan Cummings (Jan 22)
- Re: Windows Log Philippe De Ryck (Jan 23)
- RE: Windows Log dave kleiman (Jan 22)
- RE: Windows Log dave kleiman (Jan 22)
- RE: Windows Log Joe Quigley (Jan 22)
- RE: Windows Log Ramsdell, Scott (Jan 24)
- RE: Windows Log Meredith, Charles (HRD) (Jan 24)
- RE: Windows Log dave kleiman (Jan 26)
- RE: Windows Log Meredith, Charles (HRD) (Jan 26)