Home page logo
/

basics logo Security Basics mailing list archives

Re: Windows Log
From: List Spam <listspam () gmail com>
Date: Tue, 17 Jan 2006 07:08:08 -0800

There are many types of logins that can be performed in an an AD
environment.  Among these are full desktop logins by a user (aka
interactive login), non-interactive network logins (e.g. mount a
share), computer accounts authenticating to the domain, etc.

I would venture a guess that you don't want to disallow the ability to
log other security events, but want to easily find login events of
some type (see above) without having to wade through the full set of
logged data.  If this is the case, you could simply filter the logs to
show the event id that is specific to the action you are looking to
see.

You could use the built-in "Event Viewer" application for it,
EventCombMT (Google it), one of the resource kit log dumping
utilitities, VBScripts, or just about anything else to export this
info.  Some VBScript examples are below:

http://www.microsoft.com/technet/scriptcenter/scripts/logs/eventlog/default.mspx

I dare say that if you're trying to audit security on a box, you don't
want to hack up the data collection facility, but want to simply get
better use from that data.

My two cetns.

On 1/16/06, Rod <rod.rio () gmail com> wrote:
Hi all,

I have a Win2k Server, who is my Domain Controller, and I'd like it to
log only the LOGON/LOGOFF events. I know that there are a whole class
of logon/logoff events, but I´d like to log only when a user logon
into a machine in the domain.

Hope I was clear... thx


--
Rodrigo M. T. Fernandez
Departamento de Ciência da Computação UFRJ
Grupo de Respostas a Incidentes de Segurança - GRIS UFRJ
www.dcc.ufrj.br | www.gris.dcc.ufrj.br

---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
----------------------------------------------------------------------------



---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
----------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault