Audit individual user logon/logoff?

Is there a way, in a Windows NT 4 domain, to audit the logons and logoffs of an individual user, without auditing the entire user base and sifting through it?

Someone doing something aginst policies?

sorry I don't have an answer.

I think it's all or nothing thing for audit user logins. Could be wrong though. There are so many random obscure options in the registry.

- Trevor

I don't think so. At some point in the past, I wrote an application to trawl through the Event Log to pick out individual logon/logoff events, and feed them to another (billing) process.

Unfortunately, it's been so long (like 5 years or something), I can't remember how it worked any more. And part of the contract was that we had to hand over all the source code, so I can't peek.

Maybe you can find/write something similar.

I am guessing you mean through usermanager->audit so it only logs for that user rather than filtering by username once you get to the event log stage?

If so, I've been there and couldn't find anything to help. I ended up just filtering in the event log. Fortunately my site was small enough that the logs didn't end up getting too big/rolling over.

Sorry

(assuming you want to audit future activity) For logons, you could write a small login script to write a datetime string to a file. The user might notice that you're doing this though.

Interesting. All very good ideas so far.

Thanks for the tips everyone, I've got some ideas, too.