Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have contractors periodically remoting into our production servers and goodness know what changes that they could potentially make. So What can I use to log when users log on or off a server(s)?

Windows Server 2003 AD Domain

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

Audit Logon Events So I looked around and discovered you can make a group policy (and apply it to your production server OU) that can audit logon events, in other words Write an event log when people log on or off your server.

To do so, Open Group Policy Management, Then create a new group policy object in the "Group Policy Objects folder" Give it a descriptive name. Audit_Remote_logons seems good enough for me. Then go "Computer Configuration --> Policies --> Windows Settings --> Security --> Local Policy --> Audit Policy --> Then open Audit Logon Events and then enable "Success" and "Failure"

Now link the GPO the the OUs you want this enabled for.

Optionally, run "GPUdate /force" on your production servers. After this policy has been applied you can go into your security events logs and view the successful logon/logoff events.

share|improve this answer
    
I took dunxd advice and answered my own question. –  Jake Aug 6 '12 at 12:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.