Audit Logons/Logoffs

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hi

I need to Audit all logons and Logoffs in AD for a certain OU. I have
enabled the Audit Policy for that OU but where do I see the "results"
Is this the best way to do this or is there another way?
 
=?Utf-8?B?TWl0dG9uRQ==?= said:
Hi

I need to Audit all logons and Logoffs in AD for a certain OU. I have
enabled the Audit Policy for that OU but where do I see the "results"
Is this the best way to do this or is there another way?
Click to expand...

You need to apply the "Audit Account Logon" and "Audit Account Logoff" policy
to the domain controllers, not to the users. This is normally done at the
domain level, not a child OU.
 
Do I enable it at Domain Level, Default Domain Policy, Computer
Configuration, Windows Settings, Security Settings, Local Policies - Audit
Policy?
Where do I view these Audits once it has been enabled?

Thanks
 
=?Utf-8?B?TWl0dG9uRQ==?= said:
Do I enable it at Domain Level, Default Domain Policy, Computer
Configuration, Windows Settings, Security Settings, Local Policies -
Audit Policy?
Click to expand...

Correct, though it's usually advised not to alter the default domain policy,
but to create a new GPO.
Where do I view these Audits once it has been enabled?
Click to expand...

They will appear in the security event log of your domain controllers.
 
Back
Top