Need to collect the Windows logon and logoff events across the Domain in a DC eviornment, for different machines and user accounts.

Question

Hello All,
I am trying to build a Tool to collect the info about all the user's who login and logoff on daily basis in a domain network. I am using a windows 2008 server as a DC and have xp, win 7, win 8 , win 12 server as clients in the network.
There are few questions in my mind which I am not able to answer.
1> When a user tries to login to the DC network, he/ she gets authenticated using the kerberos protocol. does these authentication gets logged on the AD server by default? I have see a way to enable it from registry but even that's not giving me the expected
output in the eventvwr.
2> Do I have to use Audit policies to monitor all the user's log off and log on activities?
3> Is there a way to collect these information from any place on the AD server other than the Eventvwr?
Please help me in finding the solutions to these query's  of mine.
Thanks.

Answer 1

1. Open the Group Policy Management console on any domain controller in the target domain: navigate to Start → Administrative Tools → Group Policy Management.
2. In the left pane, navigate to Forest: <domain_name>→ Domains → <domain_name>→ Domain Controllers. Right-click the effective domain controllers policy (by default, it is the Default Domain Controllers Policy), and select Edit from the pop-up
menu. </domain_name></domain_name>
<domain_name><domain_name>3. In the Group Policy Management Editor dialog, expand the Computer Configuration node on the left and navigate to Policies → Windows Settings → Security Settings → Local Policies → Audit Policy. </domain_name></domain_name>
<domain_name><domain_name>4. Set the Audit account management and the Audit directory service access policy to "Success". Set the Audit logon events policy to  "Success" and "Failure". </domain_name></domain_name>
5. Navigate to Start → Run and type '"cmd". Input the gpupdate /force command and press Enter. The group policy will be updated.
Number of events could be excessive so you need to adjust size of Security log ( 1gb for example ) 
Usage of EventCombMT Tool (part of
MS ALtools )
 This tool gathers specific events from several different servers to one central location.
 Run the EventCombMT.exe > Right Click on Select to search field > Choose Get DCs in Domain > Mark your Domain Controllers for search
 Click the Searches menu > replace Event ID field values with
4624  LOGON / 4634  LOGOFF
 Click Search and wait for the process to complete the operation.
 After the search is done the output directory contains the log files for the domain controllers where events with the specified Event ID’s were found.
Alternatively you can try Netwrix Auditor for Active Directory solution with 20 days of free trial to generate such reports.
--- Jeff (Netwrix)