audit logon for OU

[bishop]

Hi,

Can anyone tell me if you can centrallyt log all logon
events for computers in an OU. I turned on auditing for
logons and account logons for the Domain Controller group
policy and all it grabbed were the network connections
which gave me repeat event id 540. I need to obtain a
report for all user logins to a computer for an entire OU
which details username and computer name. Also, I need to
this without going around to every computer and grabbing
the log files. Let me know if this is possible.

thanks

 

[Steven L Umbach]

If I understand you correctly, you will need to enable auditing of logon
events for the computers in the OU and then when a person logs onto a domain
computer in the OU a logon event will be recorded in the security log of the
domain computer itself. You can then use something like Event Comb, which is
free from MS, to extact data from remote computers into a text file based on
filtering of events and such. There are also third party tools that can help
manage extracting info from Event Logs, some free and some not. --- Steve


http://www.microsoft.com/downloads/...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en
http://tinyurl.com/a5zj -- same link as above, shorter.
http://www.gfi.com/lanselm/freeware.htm
http://www.sysinternals.com/ntw2k/freeware/psloglist.shtml

 

[Richard McCall [MSFT]]

You can use a reskit utility call eventcombmt.exe that can be used to
extract event logs from multiple machine