Auditing Successful Logins

[Guest]

1 of our managers wants to know when (and which) employees logon before 8a.m.
Can the logs be set to only record successful logons for a given time
period? I don't want to log all successful logons - - way too much data to
soft through.

 

[Steven L Umbach]

You can not audit selectively for account logon or logon events. The logs
are sorted by time and you can use tools like Event Comb to make searching
through the security logs much easier. There are free third party command
line tools that allow you to dump event logs to meet certain criteria such
as PsLogList. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;308471 --- Event
Comb
http://www.sysinternals.com/ntw2k/freeware/psloglist.shtml
http://www.microsoft.com/technet/scriptcenter/scripts/logs/eventlog/default.mspx
-- vbscipts for managing logs

 

[Guest]

You can create an event collection rule in MOM to only collect specified
events with-in or out of a specified time range. This also centralizes the
data in SystemCenter reporting for more comprehensive analysis and reporting.

The Manakoa System Controls MP provides a rule template that specifically
addresses this scenario. It also contains comprehensive event collection and
reporting services for similar types of compliance auditing activities.

For more information regarding the MP check out the link below.

http://manakoa.com/products/scmp/index.php

Jeremiah