RE: audit user logon activity

["David Nardoni" <dnardoni () sbcglobal net>]

EventCombMT can be used to comb through systems remotely to view their
security logs.  Event ID 528 is a logon event.
http://www.microsoft.com/technet/security/tools/default.mspx


Dave Nardoni CISSP
First Response Consulting Services, Inc.
dnardoni () firstresponseconsulting com

-----Original Message-----
From: chang zhu [mailto:cyz2000 () yahoo com] 
Sent: Wednesday, October 06, 2004 12:11 PM
To: security-basics () securityfocus com
Subject: audit user logon activity

Hi, all

I tried to find out how to find whether a user logs to multiple computers on
the network.  From MS security log, I can notfind anything I want to.  Is
there any windows freeutility which allows to audit a user's log onactivity?
(BTW, we are in windows 2000 environment).

Thanks,

chang 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around
http://mail.yahoo.com