audit trail of sessions connected to your computer

[Robert Mahaffey]

When Vista loads, a net start server command is run. This basically shares
(by default) your C drive (c$) to the entire world. IF an admin wants to
access your c: drive, he/she only has to do a net use to this computer.
QUESTION - is there any way to turn on an audit log to record these sessions
to my computer (laptop)? I initially thought this was recorded in the event
viewer - but this is not the case. Thanks for any help.

 

[Robert Mahaffey]

HERE'S THE ANSWER I RECEIVED FROM ANOTHER MICROSOFT FORUM - TESTED - AND IT
IS CORRECT. The problem was actually found when a Vista user does an
explicit NET USE to an XP system. XP does not record the device name in the
event log.


You can check the information by using the security log in Event Viewer. A
logon event 4624 will be generated in the security log when an account is
successfully logged on, and the logon type is 3 for network logon.