Windows 2000 Server login logging

[cultavix]

Good morning,

I am running a fairly small office network for a company and I am running Active Directory under Windows 2000 Server and the clients use win2k/winxp. One of the department managers is requesting from me what time someone logged in on a certain day? How can I do this? And if I can't do this, how can I enable this?

Thank you!

[cultavix]

my problem seems simply doesn't it? to bad I can't find ANYTHING, ANYWHERE on this "simple" topic ;)

[John Veteran]

You want to enable auditing. Audit successful logon security events (Y)

[cultavix]

You want to enable auditing. Audit successful logon security events (Y)

585685548[/snapback]

where do I do this? Group policy ?

[cultavix]

I just had a random thought...could I maybe figure out when she logged in from the actual computer it self? (the client/workstation)

Thanks!

[Eversurf]

The event viewer will tell you when the computer was turned on that's about it. Turn on the Auditing and yes it is in group policy

[cultavix]

I have auditing turned on but the thing is, the max event viewer disk space was set to like 512k.....I changed it to 50 megs and "no overwrite" so hopefully I can get a few months out of that...well at least for the Security Even Viewer...

[John Veteran]

A few months? :blink: If you're serious about security, you should check it once a week or so, depending how secure you want to be. If you're not going to check who's logging on that often, is it really necessary to know?

[cultavix]

Every once in a while a manager or a department head will want to know who logged on at what time or at what time did a specific person logon/logoff....

[dougkinzinger]

I, the ever-elusive DougKinzinger will post JUST FOR YOU.

Like GG said, there's no way to go back and find out if your audited security logs have already been overwritten. Nope. Nada. Sorry Charlie. In the future, bump up your overwrite time and check logs weekly. That's just good practice.

Also see Microsoft's site on "best practices" for the rookie and new network administrator:

http://www.microsoft.com/windows2000/techi...ion/default.asp

--dougkinzinger