My boss recently came to me asking when someone was logged on and when they logged off. I have enabled success and failure for both "logon events" and "account log on events." Users have since logged on and logged off but I can not find it with the event viewer on Windows 2003. Where is this stuff stored? Certainly I do not have to go to every computer and look at the logs there. Shouldn't this give me a log in the event viewer on the server?
You will need to look at the events on each computer, unless you purchase a third-party event log aggregator. Or, if you can wait until the end of year, Windows Server R2 will include the Microsoft Audit Collection Service as an integral part of the software release. You'll need a new license for that, though.
I agree that this should be easier than it is.
This was first published in July 2005
Join the conversationComment
Share
Comments
Results
Contribute to the conversation