How to make LOGON/LOGOFF events appear on the DC?

[Jeff Gottlieb]

We would like to see LOGON/LOGOFF events that appear on the DC so that
we can write a .NET program to calculate how long the users have been
logged in. This program together with a MUST LOGOFF employee policy
will help bust those employees who don't punch clocks and enjoy free
afternoons off when their bosses are out of town.

My head is thoroughly spinning after all the replies for people
requesting the differences between "Account Logon Vs. Logon Events",
etc.

We would *really* appreciate if someone could present the detailed
steps involved in making these events appear. We are with a Domain
Controller and 50 users. Thanks. -Jeff

 

[Steven L Umbach]

That is going to be difficult as domain controllers will record when a user
logs on when "account logon" events are enabled in Domain Controller
Security Policy, but not logoffs. To get logoff events you will have to
enable auditing of "logon events" on domain computer either in Domain
Security Policy or Local Security Policy and then check the security logs of
the domain workstations for logon and logoff events for the user for type 2
interactive logon. Event Comb can be used to harvest events on network
computers to a common text file log. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;308471 -- Event
Comb