Q

Filtering workstation logon events to log only user activity

Is there a way to filter out workstation logon/logoff events and only log user activity

Since we have upgraded to Windows 2000/AD, our security logs have grown very large. There seems to be a lot of logon/logoff (successful) activity between the workstation$ accounts and the Domain. I work for a hospital and must track all logon activity for users, is there a way to filter out workstation logon/logoff events and only log user activity. This is wreaking havoc on my archiving scheme. Thanks!
The granularity of the policy for logging of events does not permit the exclusion of the machine accounts. However, if you are using a scripted solution for archiving, or are willing to use such a solution you can filter the events from the logs when they are archived. The VBScript along with WMI can be utilized to pull information from event logs of multiple machines and centrally store the information. If you use this process in conjunction with an appropriate Group Policy governing size and how the information is cleared from event logs -- you can effectively store the logs after filtering unnecessary information. The logs can then be stored for long durations, backed up to tape, and reviewed at will.
Paul Hinsberg

Additional Expert Help: Be sure to check our Answer FAQ for more expert advice. For faster answers, visit ITKnowledge...

Exchange.

This was first published in December 2004

Dig Deeper on Microsoft Active Directory Tools and Troubleshooting

PRO+

Content

Find more PRO+ content and other member only offers, here.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchServerVirtualization

SearchCloudComputing

SearchExchange

SearchSQLServer

SearchWinIT

SearchEnterpriseDesktop

SearchVirtualDesktop

  • VDI assessment guide

    Wait! Don't implement VDI technology until you know your goals and needs. A VDI assessment should consider the benefits of a VDI ...

  • Guide to calculating ROI from VDI

    Calculating ROI from VDI requires a solid VDI cost analysis. Consider ROI calculation models, storage costs and more to determine...

  • Keep the cost of VDI storage under control

    Layering, persona management tools and flash arrays help keep virtual desktop users happy and VDI storage costs down.

Close