How to find user logon+logoff events in event log (after enabling audit)?

[Michael Walsh]

Yes, I enabled user auditing in SecPol.msc

Now after a few days of working (with a couple of logon+logoffs) I wanted to see in
the event log where the refering entries are.

Where are they?

I found only User="SYSTEM" logon entries in Security but no logoffs and no entries for other users.
In System log as well.

Can I audit logoffs at all?

Michael

 

[Andrew E.]

Seems like event viewer would have some details.

 

[Nepatsfan]

Yes, I enabled user auditing in SecPol.msc

Now after a few days of working (with a couple of logon+logoffs) I wanted to
see in
the event log where the refering entries are.

Where are they?

I found only User="SYSTEM" logon entries in Security but no logoffs and no
entries for other users.
In System log as well.

Can I audit logoffs at all?

Michael

When you enabled auditing, was it just for account logon events? Try auditing
logon events instead.

Good luck

Nepatsfan