Ask the Expert

Keeping track of data in the event log on Windows 2003

My boss recently came to me asking when someone was logged on and when they logged off. I have enabled success and failure for both "logon events" and "account log on events." Users have since logged on and logged off but I can not find it with the event viewer on Windows 2003. Where is this stuff stored? Certainly I do not have to go to every computer and look at the logs there. Shouldn't this give me a log in the event viewer on the server?

You will need to look at the events on each computer, unless you purchase a third-party event log aggregator. Or, if you can wait until the end of year, Windows Server R2 will include the Microsoft Audit Collection Service as an integral part of the software release. You'll need a new license for that, though.

I agree that this should be easier than it is.

This was first published in July 2005

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: