logfile file determine who has logged in?

[Kevin]

On Windows XP, assuming root/Administratorprivileges, is there a
logfile that records when users have logged in/out? My first look at
*.log files only shows files that are locked in use.

What I am really looking for is log files that record user activity in
more detail, but login/out is a start. TIA.

 

[Carey Frisch [MVP]]

HOW TO: Audit User Access of Files, Folders, and Printers in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310399&Product=winxp

R-Guard Data Security Software
http://www.data-security-software.com/

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User
Microsoft Newsgroups

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/default.mspx

------------------------------------------------------------------------------

:

| On Windows XP, assuming root/Administratorprivileges, is there a
| logfile that records when users have logged in/out? My first look at
| *.log files only shows files that are locked in use.
|
| What I am really looking for is log files that record user activity in
| more detail, but login/out is a start. TIA.

 

[Torgeir Bakken \(MVP\)]

On Windows XP, assuming root/Administratorprivileges, is there a
logfile that records when users have logged in/out? My first look at
*.log files only shows files that are locked in use.

What I am really looking for is log files that record user activity in
more detail, but login/out is a start. TIA.

Hi

If you enable auditing of logon events, you will find entries for
logons and logoffs in the security event log.

Auditing of logon events has to be enabled on the computer via Local
Security Policy or possibly domain level if in a domain. Then you can
search the security log for the following events:

Interactive logon: Event ID 528 containing Logon Type 2
Interactive logoff: Event ID 538 containing Logon Type 2


HOW TO: Audit User Access of Files, Folders, and Printers in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310399