I'm trying to find an effective way to monitor user login and logout times in a Windows Domain environment. I've checked client computers, but the security event logs are cluttered with packet filtering events, and they only show logs from about 18 hours back. The same goes for the domain controller. I've already enabled login/logout event logging via Group Policy, as we're using Sophos authentication, but there's just too much noise in the logs.
What I'm really looking for is a straightforward solution that can help track when users sign in and out, perhaps to manage their hours better or to identify any unauthorized activity. I did consider scripting, but I'm not sure it would handle sign-outs well because many users just leave their sessions running.
We have a Windows Server VM on Azure, but we've removed the local server where I could have set up Linux to gather logs. I'd appreciate any advice you all might have! Thanks!
5 Answers
Most SIEM solutions can monitor these events if configured correctly. Just make sure you're tracking the specific event IDs related to logon and logoff times!
Setting login restrictions for specific times can help manage when people can log in. To handle unauthorized activities, ensure users don’t have permissions for actions you don’t want them to take.
Using logon scripts is a very simple way to track this. They can automatically log when users sign in and out without needing a lot of fuss.
You might want to consider forwarding your logs to a Security Information and Event Management (SIEM) tool. Plus, a logon/logoff script can be really helpful. For instance, you can have a script that echoes the logon details to a text file on a file share. Also, set working hours in Active Directory to restrict access outside these times.
You can filter specific events like 4624 (logon) and 4634 (logoff) to get the duration. If you're using Splunk, there's a resource here: gosplunk.com/user-logon-session-duration. There are also tools like ManageEngine and Netwrix that might help with monitoring employee logon durations.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures