Skip navigation

JSI Tip 0264 - Auditing logons.

When you enable auditing of logons in User Manager for Domains \ Policies \ Audit.., records appear in your Security log in the Event Viewer.

Many of these records appear to be identical at the summary level but if you view the detail you will see a difference. Here are the common logon/logoff events:

 D e s c r i p t i o n  Event ID  Event Type
 Interactive logon      528       2
 Interactive logoff      538       2
 Network logon      528       3
 Net Use connection*       528       3
 Network logoff      538       3
 Net Use disconnection       538       3
 Autodisconnect      538       3

Note: * - An event is only generated by the initial connection from a particular user.
              Subsequent Net Views or Net Uses from the same user to the same computer do not generate any
              additional events unless the user has disconnected (or has been autodisconnected) from all shares.

See tip 749, More on auditing logons.

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.