My boss recently came to me asking when someone was logged on and when they logged off. I have enabled success and failure for both "logon events" and "account log on events." Users have since logged on and logged off but I can not find it with the event viewer on Windows 2003. Where is this stuff stored? Certainly I do not have to go to every computer and look at the logs there. Shouldn't this give me a log in the event viewer on the server?
You will need to look at the events on each computer, unless you purchase a third-party event log aggregator. Or, if you can wait until the end of year, Windows Server R2 will include the Microsoft Audit Collection Service as an integral part of the software release. You'll need a new license for that, though.
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
I agree that this should be easier than it is.