Tracking User Logon Activity Using Logon Events

re: Tracking User Logon Activity Using Logon Events

Adam — Mon, 13 Feb 2012 16:31:37 GMT

Eric, thanks for this information. I want to track MY OWN time without messing with some tray software, so this is very helpful information. In fact, your warnings help me make sure I don't *accidentially* circumvent my own logging.

re: Tracking User Logon Activity Using Logon Events

Eric Fitzgerald — Fri, 03 Jun 2011 17:21:54 GMT

Hi Mike,

I'm not sure what you're trying to say here. It's obvious you took offense at something, but I don't know what that is.

There's no way to reliably perform this task, and it's often undertaken in the context of some sort of investigatory action against a user, therefore I don't recommend it. There is a significant potential for misinterpretation, and therefore the possibility of coming to an incorrect conclusion about a user's behavior.

I bothered posting at all because I know that there are many people who are asked to do this, so I explained how to do it as reliably as is possible.

You're free to take my advice or ignore it. It's up to you.

Best regards,

Eric

re: Tracking User Logon Activity Using Logon Events

Mike — Fri, 03 Jun 2011 13:23:49 GMT

For a company, screen lock, not screensaver is fairly common. Ours is set to 15 minutes due to our interpretation of FIPS140-2 for HIPAA/HITECH. For remote workers, it is very nice to be able to see how often a user is logged in. You can't possibly know what everyone in the world does for a job. They may not have tasks that churn on their computer. They may not have a screensaver at all, just a screen lock. They may use IE all day long for cloud based work. You presume too much based on your own experience. Thanks for the help, just don't hit me over the head with a club and call me stupid for doing my job.

re: Tracking User Logon Activity Using Logon Events

@mescwb — Fri, 06 May 2011 00:23:27 GMT

Its useful to know exact logon times when investigating changes done by rougue admins :)

re: Tracking User Logon Activity Using Logon Events

mescwb — Thu, 24 Feb 2011 19:50:32 GMT

rant... yes ;)

why some would bother to know the EXTACT time someone 'really' used a computer...

coming to lock or screen saving does not mean one is not 'working'

yet about remote accessmonitoring cases: many tasks may be manual 'batches' and we leave the session come idle - but we are at dispposal of the employer/customer or working in another stuff in the meantime

just my 2c