Audit Logons

[Apparition]

I want to audit account logons for my DC, so that an event
is logged whenever a user logs on to the domain from any
workstation. However, I don't want to log every single
event which is logged by the DC when success audits are
switched on, such as event 673's and 538's, as I'm logging
thousands of events per day!. Is there a way to stop
these events being logged but still log user account
logon's?

 

[Steven L Umbach]

You might try to audit just account logon events and not both account logon
and logon events if that is what you are doing. Otherwise there is really no
way around it, but you can use filter view in Event Viewer or other tools
such as Event Comb to scan the logs just for certain events that interest
you. --- Steve

http://www.microsoft.com/downloads/...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en
--- Event Comb availabe here
http://www.microsoft.com/technet/tr...curity/prodtech/win2000/secwin2k/09detect.asp