How to find user logon+logoff events in event log (after enabling audit)?

  • Thread starter Thread starter Michael Walsh
  • Start date Start date
M

Michael Walsh

Yes, I enabled user auditing in SecPol.msc

Now after a few days of working (with a couple of logon+logoffs) I wanted to see in
the event log where the refering entries are.

Where are they?

I found only User="SYSTEM" logon entries in Security but no logoffs and no entries for other users.
In System log as well.

Can I audit logoffs at all?

Michael
 
Michael Walsh said:
Yes, I enabled user auditing in SecPol.msc

Now after a few days of working (with a couple of logon+logoffs) I wanted to
see in
the event log where the refering entries are.

Where are they?

I found only User="SYSTEM" logon entries in Security but no logoffs and no
entries for other users.
In System log as well.

Can I audit logoffs at all?

Michael
Click to expand...


When you enabled auditing, was it just for account logon events? Try auditing
logon events instead.

Good luck

Nepatsfan
 
Back
Top