Capturing NT4 Login/out
Name: Chuck W.
CHow can one capture the login and logout time of a user's
NT 4.0 session.
I realize that user.dat in the ..\profiles\ directory will reflect
the logout time.
I am wondering if there are some registry entries that reflect both.
And if a user never logs off the NT 4.0 system, how would one capture any
new activity on the keyboard? For instance identifying any activity after
a 2 hour idle period.
Chuck, that is a great question!
To answer your question in regards to
track when a user logs into an NT computer as well as logging out, you can
set up Auditing. When you enable auditing, you can track when the user
logs in and out, this is displayed in the form of a security audit in the
security log of the domain controller if no domain controller is present
the audit will appear in the local security log of the computer. If a user
never logs off the machine and you would like to capture any keystrokes,
you can install a software package called Boss Everywhere, this software
package contains a client and server application. The client piece of the
software will capture any keystrokes on the computer and then send them to
a server where they can be reviewed for your inspection you can also set up
special alarms so when an action takes place or if you computer is idle for
any given time, you can cause an event to occur. I hope this helps!
MCSE, MCSA, CCNA Certified
Windows 2000 Active Directory Specialist
Click here to return to the Computer Science Archives
Update: June 2012