Announcement

Collapse
No announcement yet.

Audit Logon events log entries problem

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Audit Logon events log entries problem

    Hello,

    I would like to configure our Group Policy in this way that all User logon events would be logged in Event Logs (Audit Logon events).

    I configured Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit logon Events, like it is described on http://technet.microsoft.com/en-us/l.../cc787567.aspx, but the problem is that logon events are logged only on workstation's Event logs on which user has logged in.

    I would like that all of logon events from every workstation in our organization are combined on one central location (maybe DC Event Viewer) or somewhere else. How can I achieve this?

    Thank you for your help!

    Best wishes,
    Marko

  • #2
    Re: Audit Logon events log entries problem

    I have found no MS way that does this automatically. our solution was to run a a script daily to collect all the logs at a central point, I used Powershell, and it works pretty nice to collect logs from 300+ servers.

    Comment


    • #3
      Re: Audit Logon events log entries problem

      BSonPosh has a script that will doit, dig around his blog for it.
      http://bsonposh.com/

      Comment


      • #4
        Re: Audit Logon events log entries problem

        Hi Marko,

        In order to achieve what you need you'll have to configure a GPO to Enable auditing for Member Server objects or edit the Default Domain Controllers policy to enable Auditing (Although the later is not recommended).
        That way you'll get all Event entries for Domain Accounts on your Member server Event logs or the DC event Log.
        Have a look at this link for more info: http://technet.microsoft.com/en-us/l.../cc163121.aspx

        Ta
        Caesar's cipher - 3

        ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

        SFX JNRS FC U6 MNGR

        Comment


        • #5
          Re: Audit Logon events log entries problem

          Hello,

          thank you all for a lot of good advices. I will try all of this options and if I stuck again, I will ask you for more help.

          Thank you!

          Best wishes,
          Marko

          Comment

          Working...
          X