Can you log the use of a workstation?

[Your name]

Hello,

We have a situation here that unfortunately, merits this question. The
situation; we have an employee that is claiming to spend many hours on
the weekend on their workstation, but we suspect that is actually not
the case. The question; is there a way to log the use of a user on the
workstation that they are working on?

TIA for your reply.

 

[Steven L Umbach]

You can enable auditing of logon events in the Local Security Policy of that
computer. Just make sure that he is not also an administrator if at all
possible because if he got wind of that, he may be able to configure a
scrip/AT or Scheduled Task to have the computer log him off at a certain
time or change the system time. You can also search for files on his
computer and select the option to search by date and select a range. That
information may be helpful in showing what files he closed/modified at what
times or also checking the properties of the files in his folder for
modified time stamp. --- Steve

 

[Your name]

You can enable auditing of logon events in the Local Security Policy of that
computer. Just make sure that he is not also an administrator if at all
possible because if he got wind of that, he may be able to configure a
scrip/AT or Scheduled Task to have the computer log him off at a certain
time or change the system time.

We don't have to worry about that, the user isn't savvy enough to do that.

You can also search for files on his computer and select the option to search
by date and select a range. That information may be helpful in showing what
files he closed/modified at what
times or also checking the properties of the files in his folder for
modified time stamp

We've done that, but the problem is that we cannot tell precisely how long it
took for the user to actually work on the file, and we don't know when the user
started the application to modify the file.

BTW, is there a way to at least see what apps were opened and for how long?

 

[Jeff Cochran]

We have a situation here that unfortunately, merits this question. The
situation; we have an employee that is claiming to spend many hours on
the weekend on their workstation, but we suspect that is actually not
the case. The question; is there a way to log the use of a user on the
workstation that they are working on?

Auditing the logon event would tell you, as would a login script that
writes a log file. But why isn't anyone just stopping in on the
weekend to check? You have a management problem, not a technical one.

Jeff

 

[Steven L Umbach]

You could try enabling auditing of process tracking but be sure to make the
security log quite a bit bigger. Also look into enabling of object access
and the audit the specific files in question, including executeables. The
information will be in the logs, but it will take a while to sort it all
out. I would try the file auditing before using process tracking, but audit
only a few permissions for as few files as possible to keep the number of
events generated down. --- Steve

http://support.microsoft.com/default.aspx?scid=KB;en-us;q248260

 

[Andrew Mitchell]

We've done that, but the problem is that we cannot tell precisely how
long it took for the user to actually work on the file, and we don't
know when the user started the application to modify the file.

Are you talking about MS Office applications?
If you are, you can view the properties for the document etc. and in the
summary information it will tell you how long the file has been open for (in
total)

 

[Your name]

You're right. It is a managment problem, but the manager doesn't want to
have to drive 45 minutes just to "pop in", because the times that the
weekend employee comes in are set by the employees discretion, so the
manager has no idea when to expect the employee to be in. That's why we
want to try this first.

 

[Your name]

No. Actually it is an AutoCAD application.

Are you talking about MS Office applications?
If you are, you can view the properties for the document etc. and in the
summary information it will tell you how long the file has been open for (in
total)

 

[Your name]

Thanks Steve,

I'm going to look into it.

You could try enabling auditing of process tracking but be sure to make the
security log quite a bit bigger. Also look into enabling of object access
and the audit the specific files in question, including executeables. The
information will be in the logs, but it will take a while to sort it all
out. I would try the file auditing before using process tracking, but audit
only a few permissions for as few files as possible to keep the number of
events generated down. --- Steve

http://support.microsoft.com/default.aspx?scid=KB;en-us;q248260