Unoffical empeg BBS

Quick Links: Empeg FAQ | RioCar.Org | Hijack | BigDisk Builder | jEmplode | emphatic
Repairs: Repairs

Topic Options
#116011 - 11/09/2002 15:22 Audit individual user logon/logoff?
tfabris
carpal tunnel

Registered: 20/12/1999
Posts: 31563
Loc: Seattle, WA
Is there a way, in a Windows NT 4 domain, to audit the logons and logoffs of an individual user, without auditing the entire user base and sifting through it?
_________________________
Tony Fabris

Top
#116012 - 11/09/2002 16:47 Re: Audit individual user logon/logoff? [Re: tfabris]
muzza
Pooh-Bah

Registered: 21/07/1999
Posts: 1765
Loc: Brisbane, Queensland, Australi...
Someone doing something aginst policies?

sorry I don't have an answer.
_________________________
-- Murray I What part of 'no' don't you understand? Is it the 'N', or the 'Zero'?

Top
#116013 - 11/09/2002 16:57 Re: Audit individual user logon/logoff? [Re: tfabris]
tman
carpal tunnel

Registered: 24/12/2001
Posts: 5528
I think it's all or nothing thing for audit user logins. Could be wrong though. There are so many random obscure options in the registry.

- Trevor

Top
#116014 - 12/09/2002 01:33 Re: Audit individual user logon/logoff? [Re: tfabris]
Roger
carpal tunnel

Registered: 18/01/2000
Posts: 5680
Loc: London, UK
I don't think so. At some point in the past, I wrote an application to trawl through the Event Log to pick out individual logon/logoff events, and feed them to another (billing) process.

Unfortunately, it's been so long (like 5 years or something), I can't remember how it worked any more. And part of the contract was that we had to hand over all the source code, so I can't peek.

Maybe you can find/write something similar.
_________________________
-- roger

Top
#116015 - 12/09/2002 01:36 Re: Audit individual user logon/logoff? [Re: tfabris]
Shonky
pooh-bah

Registered: 12/01/2002
Posts: 2009
Loc: Brisbane, Australia
I am guessing you mean through usermanager->audit so it only logs for that user rather than filtering by username once you get to the event log stage?

If so, I've been there and couldn't find anything to help. I ended up just filtering in the event log. Fortunately my site was small enough that the logs didn't end up getting too big/rolling over.

Sorry
_________________________
Christian
#40104192 120Gb (no longer in my E36 M3, won't fit the E46 M3)

Top
#116016 - 12/09/2002 01:45 Re: Audit individual user logon/logoff? [Re: tfabris]
David
addict

Registered: 05/05/2000
Posts: 623
Loc: Cambridge
(assuming you want to audit future activity) For logons, you could write a small login script to write a datetime string to a file. The user might notice that you're doing this though.

Top
#116017 - 12/09/2002 03:27 Re: Audit individual user logon/logoff? [Re: David]
tfabris
carpal tunnel

Registered: 20/12/1999
Posts: 31563
Loc: Seattle, WA
Interesting. All very good ideas so far.

Thanks for the tips everyone, I've got some ideas, too.
_________________________
Tony Fabris

Top