Login Auditing

Home | NewsGroups | Search | About

microsoft.public.windows.server.security

get this group's latest topics as an RSS feed

add this group's latest topics to your My MSN content

add this group's latest topics to your My Yahoo content

Subject

Author

Date

Lee Hundley

06-17-2005

Roger Abell

Lee Hundley

Roger Abell

Lee Hundley

Roger Abell

Posted by Lee Hundley on June 17, 2005, 11:05 am

Please log in for more thread options

I've been asked to make our Win2k3 server audit user logins, and e-mail a
report to a user at a specified time so we can tell if employees are
showing up for work on time. I've been over the logging/auditing
documentation and have become increasingly confused by the various event
codes and what-not. Is there a simple (hah) way to accomplish this? 3rd
party app? If this is a RTFM issue, could someone please point me which
"FM" I should "R"?

Note: I'm used to Unix servers, this is all foreign to me. I did notice
that there are Unix syslog implementations for Windows, might this be a
viable option?

Posted by Roger Abell on June 19, 2005, 12:48 am

Please log in for more thread options

Installing syslog does not redirect the Windows event messages
into it. Go to microsoft.com/downloads and get LogParser.
Enable both logon categories in a the Audit policies section of
a GPO that is linked to the domain or domain controllors OU.
Then, figure up a scheduled task that kicks off to grep out a
report of the first login per domain user seen since midnight or
some suitable time threshold. You might also want to visit
http://www.logparser.com/

--
Roger Abell
Microsoft MVP (Windows Security)

> I've been asked to make our Win2k3 server audit user logins, and e-mail a

> report to a user at a specified time so we can tell if employees are

> showing up for work on time. I've been over the logging/auditing

> documentation and have become increasingly confused by the various event

> codes and what-not. Is there a simple (hah) way to accomplish this? 3rd

> party app? If this is a RTFM issue, could someone please point me which

> "FM" I should "R"?

> Note: I'm used to Unix servers, this is all foreign to me. I did notice

> that there are Unix syslog implementations for Windows, might this be a

> viable option?

Posted by Lee Hundley on June 21, 2005, 9:58 am

Please log in for more thread options

On Sun, 19 Jun 2005 01:48:13 -0700, Roger Abell wrote:

> Installing syslog does not redirect the Windows event messages

> into it. Go to microsoft.com/downloads and get LogParser.

> Enable both logon categories in a the Audit policies section of

> a GPO that is linked to the domain or domain controllors OU.

> Then, figure up a scheduled task that kicks off to grep out a

> report of the first login per domain user seen since midnight or

> some suitable time threshold. You might also want to visit

> http://www.logparser.com/

Thanks for the tip. I've got it installed and have been working with it,
but can't seem to form a query to explicitly isolate real interactive
logins. I've gotten quite close, but was wondering if anyone else with
LogParser experience could help me narrow this down a bit.

LogParser "SELECT DISTINCT TimeGenerated AS LogonDate, RESOLVE_SID(sid)
AS Account, Message INTO Report.html FROM Security WHERE EventID NOT IN
(541;542;543) AND EventType = 8 AND EventCategory = 2 AND TimeWritten >=
SUB( TO_LOCALTIME(SYSTEM_TIMESTAMP()), TIMESTAMP('4', 'h') ) AND
EXTRACT_TOKEN(Strings, 0, '|') NOT LIKE '%%$' AND RESOLVE_SID(SID) NOT
LIKE '%%ANON%%'" -i:EVT -o:TPL -tpl:MyTemplate.txt

Any Takers?

Posted by Roger Abell on June 22, 2005, 12:32 am

Please log in for more thread options

Lee,
I guess it resolves down to just what you consider "real" interactive
logins as compared to your already narrowed to "EventCategory = 2"
I am assuming you want to rule out such as website authoring that does
a type 2 login, etc..

Can you either 1) characterize a string-form for the workstations where
the login happens that are considered "real" interactive, or 2) characterize
machines where type 2 that are not "real" per your criteria are being seen?

I mean, the problem is that type 2 login is type 2 login, so you will need
to leverage some other determining factor.

--
Roger Abell
Microsoft MVP (Windows Security)

> On Sun, 19 Jun 2005 01:48:13 -0700, Roger Abell wrote:

> > Installing syslog does not redirect the Windows event messages

> > into it. Go to microsoft.com/downloads and get LogParser.

> > Enable both logon categories in a the Audit policies section of

> > a GPO that is linked to the domain or domain controllors OU.

> > Then, figure up a scheduled task that kicks off to grep out a

> > report of the first login per domain user seen since midnight or

> > some suitable time threshold. You might also want to visit

> > http://www.logparser.com/

> Thanks for the tip. I've got it installed and have been working with it,

> but can't seem to form a query to explicitly isolate real interactive

> logins. I've gotten quite close, but was wondering if anyone else with

> LogParser experience could help me narrow this down a bit.

> LogParser "SELECT DISTINCT TimeGenerated AS LogonDate, RESOLVE_SID(sid)

> AS Account, Message INTO Report.html FROM Security WHERE EventID NOT IN

> (541;542;543) AND EventType = 8 AND EventCategory = 2 AND TimeWritten >=

> SUB( TO_LOCALTIME(SYSTEM_TIMESTAMP()), TIMESTAMP('4', 'h') ) AND

> EXTRACT_TOKEN(Strings, 0, '|') NOT LIKE '%%$' AND RESOLVE_SID(SID) NOT

> LIKE '%%ANON%%'" -i:EVT -o:TPL -tpl:MyTemplate.txt

> Any Takers?

Posted by Lee Hundley on June 22, 2005, 10:42 am

Please log in for more thread options

On Wed, 22 Jun 2005 01:32:43 -0700, Roger Abell wrote:

> Lee,

> I guess it resolves down to just what you consider "real" interactive

> logins as compared to your already narrowed to "EventCategory = 2"

> I am assuming you want to rule out such as website authoring that does

> a type 2 login, etc..

Yes, I'm trying to determine when the user physically sat down at the
console and logged in. Maybe I should just hook a pressure sensitive
switch into their chair. :)

> Can you either 1) characterize a string-form for the workstations where

> the login happens that are considered "real" interactive, or 2) characterize

> machines where type 2 that are not "real" per your criteria are being seen?

> I mean, the problem is that type 2 login is type 2 login, so you will need

> to leverage some other determining factor.

Thanks for the insight! I noticed that the machine I use for backups was
causing a lot of these logins and eliminated it through modifying that
query slightly. After clearing out the anonymous, administrator, and my
own account (used for backing up), it's readable enough for management. I
could probably narrow it down to an exact entry using grep/awk, but
meh.

Thanks for your input, and here's the final query for anyone that
needs to do this same thing.

LogParser "SELECT DISTINCT TimeGenerated AS LogonDate, RESOLVE_SID(sid)
AS Account, Message INTO CorbelLogins.html FROM Security WHERE EventID NOT
IN (541;542;543) AND EventType = 8 AND EventCategory = 2 AND TimeWritten

>= SUB( TO_LOCALTIME(SYSTEM_TIMESTAMP()), TIMESTAMP('4', 'h') ) AND

EXTRACT_TOKEN(Strings, 0, '|') NOT LIKE '%%$' AND RESOLVE_SID(SID) NOT
LIKE '%%ANON%%' AND RESOLVE_SID(SID) NOT LIKE '%%leeh' AND
RESOLVE_SID(SID) NOT LIKE '%%administrator'" -i:EVT -o:TPL
-tpl:MyTemplate.txt

Similar Threads	Posted
Login Script Question - Failed Login Count, Location, and Method	October 5, 2005, 6:28 pm
Auditing Security	July 22, 2005, 1:21 pm
Auditing user OU Changes	February 14, 2008, 11:48 am
Class on Rights and Auditing	July 18, 2005, 11:41 am
Auditing on a member server	November 9, 2005, 2:30 pm
Auditing Workstation logons from DC	January 24, 2006, 7:29 pm
Auditing process kills	February 28, 2007, 2:01 pm
security auditing on a share	March 1, 2007, 4:13 pm
Auditing Security Events	May 10, 2007, 1:54 am
Enterprise file auditing	May 17, 2007, 8:08 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML Sitemap

XML Sitemap