Auditing users logoff times??

albanga

Hi all,

I am trying to set-up a rule in group policy that allows me to check what time users are loggin off at night, but am having troule doing so.

For some reason all it keeps doing is showing failure audit attempts, even when success is ticked. At the present time i am just going around in circles.

Could someone please give me some suggestions as to where i apply the policy and what rule i should be using.

It has been suggested that it is done at "account logon events", but if thats the case do i need to turn off some of the other policies.

Like i said all i want to do is monitor our users to see which ones are loggin off late at night. On top of this is there a way to get the information of these users into some sort of spreadsheet or database.

If it works, it would seem like a lot of work to have to go through the event viewer and sift trough hundreds of events to look at times.

eurotrash

You can try either Audit account logon events or Audit logon events or both. Try configuring it in the default domain policy. And no, you don't need to turn off other policies for whatever reason

You can use the filter in event viewer to sort through the entries, and/or you can export the file as comma delimited or tab delimited, which are made for importing into spreadsheet or whatever programs.