Q

Keeping track of data in the event log on Windows 2003

Site expert Jonathan Hassell reveals tools that will keep track of logon and logoff data in the event viewer on Windows 2003.

My boss recently came to me asking when someone was logged on and when they logged off. I have enabled success and failure for both "logon events" and "account log on events." Users have since logged on and logged off but I can not find it with the event viewer on Windows 2003. Where is this stuff stored? Certainly I do not have to go to every computer and look at the logs there. Shouldn't this give me a log in the event viewer on the server?

You will need to look at the events on each computer, unless you purchase a third-party event log aggregator. Or, if you can wait until the end of year, Windows Server R2 will include the Microsoft Audit Collection Service as an integral part of the software release. You'll need a new license for that, though.

I agree that this should be easier than it is.

This was first published in July 2005

Dig deeper on Windows legacy operating systems

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchVirtualDesktop

SearchWindowsServer

SearchExchange

Close