|
I'm completing an audit and need to know the following information below. I have a domain controller with active directory, but let me know if you need any more info. I would like something as simple as possible.we have around 230 pc so would take a long time to go around all of them one by one. any suggestions welcome! Thanks. | |||
|
feedback
|
|
You would want to enable Audit Logging on your DC. If you don't have auditing enabled now, you won't be able to gather this information until you enable it. The easiest way to do this would be through Group Policy. Open the Group Policy Management Console and right click and choose "Edit..." on the "Default Domain Controller Policy" that is linked to the Domain Controllers container. Drill down to "Computer>Windows>Security Settings>Local Policies>Audit Policy". You'll want to enable the "Audit Account Logon" and audit either "successful" attempts, "failed" attempts, or both. You haven't mentioned what OS your DC is running. If it's 2008/ 2008 R2 you have some additional Auditing options. The above settings will generate events in the Security Event log on your DCs when a users logs on to a domain PC. Even with auditing set, you still need to go through your event logs to gather the information. | ||||
|
feedback
|
|
Cheekaleak is correct, you would have to enable auditing in the first place to start gathing that type of information in the security logs. Having that information in the logs isn't particularly useful however, since it's quite difficult to create a report from this info. You could install an event log monitoring solution like EventSentry which includes logon tracking and other compliance tracking options that enable better reporting (also see compliance features). EventSentry can also distinguish between logons by administrators and mere mortals (e.g. domain user). Disclaimer: I work for NETIKUS.NET. | |||
|
feedback
|
