User audit enabled - Only log off

Hai all,
10.2.0.5 on solaris 10
I enabled audit for a user as below
audit username by access;
When I query dba_audi_trail, I can see only actions (LOG_OFF) stored in the action_name column of dba_audit_trail.
Any idea

Are you talking about " audit session by username by access" ?? the statement you mentioned doesnt exist, and if you mean what i mentioned, try logging in with the username after you logout , you should see logon value in action_name column and action value should be 100, assuming its was also in 10g because i work on 11g. Also you should see logoff_time when you logout but null value when you login.
Regards
Karan

Similar Messages

Master Enable User to enable only OIM account and not the resoruce accounts

Hi Experts -
I have a requirement wherein when the user is rehired, only the OIM profile has to be enabled and not the resource accounts on the user profile.
How can we acheive this?
Thanks
Kunal Jain

How do you know if the person is rehired? You can create disable task on the process and have your adapter there to check if it's a rehire. If infact this is a rehire then donot enable the user else call the actual conditional enable task.
-Bikash

User Audit and Security log

Hello Experts,
We are using an ECC 6.0 systems. My question is apart form SM19 is there any other t_code to trace the user action that is a more detail trace on user action.
As you know SM19 settings will offer us the basic action of user that is what t_code or reports are being used by user. But I want to know what are they doing there that is they are trying to access some infortype in t_code like PA30 or they made in table definition change in SE16 like that.
Please let me know about this.
Thanks in advance.
Regards,
Partha

Hi Partha,
You can use the following TCodes also.
1. STAD
2. STAT
STAD and STAT can also be navigated from ST03N. If you want to log a particular TCode (for e.g. PA30), then please follow the below steps:
Go to ST03N -> Expert user mode -> Collector & Performance DB -> Workload collector -> Parameters.
Enter the transaction codes for the transactions to be analyzed in detail in the Create transaction detail profiles for group box. Save your changes. (please read the message carefully in this screen).
3. STATTRACE
4. SM21
If you are in SM21, then please select all the options in "Settings" radio button. After getting the display of Log screen, you can further analyze a message in more details by double clicking it.
Still SM20 is really a good choice to view user actions.
Please re-check (in SM19) that all the Audit Classes are selected for the current filter you are analyzing. Before reading the audit log make sure to include all Instances (telling this, just to be sure).
Mark all in "Events" and "Statistic" tabs. Now display the data selecting the particular user and tcode.
Hope this discussion may help you to some extent. Please let me know for any more query.
Regards,
Dipanjan

Enterprise Portal Log off Issue for External User

Hello
We are facing a Enterprise Portal log off issue for one of our external users.
User is logged in and clicks on the "Log Off" link .
User is prompted as seen below:
Are you sure you want to logg off?
Choose Yes or No
Click on Yes and popup window goes away and nothing else happens.
These problems logg off issue problem happening on Internet Explorer 6 but from from firefox browser, its working.
Also popups are not blocked on IE.
EP version with SP level is EP 7.00 SP12.
Even though from Internet explorer 6, i can log in and log off with internal user.
Please advise for the log off problem .

Hello
I added the value ume.logoff.redirect.url =https://poqwas.synenco.com/irj/portal
on Config Tool Global Paramter settings.
Then restart the server.
But I am getting the same problem.when I login with external user ID, then make log off. Nothin Happen...
Please advise

GPUpdate /force - suddenly, the users are being asked to log off to finalize the update

Win7, Server 2008R2, IE9 - Not sure what changed or when, but if I run GPUpdate /force, the users is told to log off before the updates take place. Any ideas as to what causes this? Even if the GPO isn't changed, users are still required to log off.
Charlie Newman

> maybe Folder Redirection?
As far as I know:
Folder Redirection
MSI deployment
Scripts
Disk quotas
GPP Drive Maps
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

User Audit Trail for a custom table.

Hello all. I need to know the correct and accurate way to user audit for a custom table. To elaborate further, I have a table catering to sanctioned strength of employees in a particular Cost Center, the entries have been deleted all together by someone, and I need to know the way to recover the data and to identify the user in question. Note, I have used STAT and have foundno results, and standard user audit trail are turned off.
Any help or push in the right direction would be highly appreciated.
P.S: any additional technical details on the table structure can be provided for further analysis if needed.

Try to add your custom table and table fields in the below views
V_T585A
V_T585B
V_T585C
After doing this your custom table changes gets stored in the pcl4 document . If the custom table is master data table then from the standard Audit trail report you can see the logged changes in custom table also by providing the custom infotype number.
if its is custom customizing table , need to explore

Capturing the LOG OFF url click action in a Webdynpro application

Hi,
I have this requirement where I need to know when the User logs off in a webdynpro application.
I have several webdynpro applications, each independent, and each need to do some clean up tasks when the user clicks on the LOG OFF url in the portal login.
Is there some standard event attached with the LOG OFF Url of the portal login?
And could anybody please specify when exactly would the <i>wdDoExit()</i> method of the application view(s) or the application component controller get's trigerred when the application is run from the portal login?
Thanks in Advance.
Regards,
Swapna Priya.

Hi Luciano,
I was successfully able to call the RFC from wdDoExit() method of the component controller.
Also I could successfully place a custom alert call when the user clicks on the LOGOFFurl in the portal browser.
Now I have one more pending requirement for me to completely use this cycle of events.....The Portal Browser close action i.e., 'X' action.
I did find a forum link with some code for the same but i did not understand where to place that code and have already raised a reply for hte same.
Below is the link:
/message/230174#230174 [original link is broken]
Do you have any idea about how to trap this?
Thanks for all your support
Regards,
Swapna Priya.

When I atempt to send a web site via an email from FF, the system keeps opening one new mozalla screen after another. Nothing will stop this but logging off. I have to bookmark everything and then put it in an email. Your help is appreciated.

If I attempt to send a link to someone from a site I am visiting, ff starts opening one new start window after another. So fast i can't get it stopped. Even going into taskmaster which I sometimes have to try 3 or 4 times, it is impossible to get them all stopped they just keep multiplying. Only logging off or a restart will fix the problem.
The same think happens if I use a "send picture to". I don't know what else to do. I have run all the diagnostics I have. Checked all the drives, etc. Check all the ff settings. Nothing shows.

http://support.mozilla.com/en-US/kb/Managing+file+types
Don't set Firefox for '''mailto'''. <br />
http://support.mozilla.com/en-US/kb/Changing+the+e-mail+program+used+by+Firefox

How to run a batch before window log off

We have a situation. We monitor an application very closely for failure rate. Many users are currently just logging off windows when leaving work. When they use windows log off it kills this application which intern return non-zero exit code(indicating application
problem).
Is there a way to run a batch/powershell script to close application first(we have a method to close it gracefully) before log off process is triggered by windows 7.
We tried putting a routine in GPO log off script. But widows log off kills all applications before the routine has chance to run.
Please help.

Hi,
Create a batch file and insert the shutdown command in the last line. When you want to shutdown computer, just run this batch file.
Alex Zhao
TechNet Community Support

Security log 4634 shows another user logging off

Security log shows users logoff that weren't even using the machine. There are no 4642 logon logs, just the 4643 logoff logs.
These user aren't even accessing another machine via the network. All machines also have no malware or virus on them.
Logon Type: 3
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
What could be causing this?

It's a domain enviroment. Printers are all through a Print Server.
Below is the log of 1 such event.
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 2014-04-04 03:04:24 PM
Event ID: 4634
Task Category: Logoff
Level: Information
Keywords: Audit Success
User: N/A
Computer: (computer name.domain)
Description:
An account was logged off.
Subject:
Security ID:
S-1-5-21-213254720-224688177-246369
Account Name:
(username)
Account Domain:
(domain)
Logon ID:
0x197EC67
Logon Type: 3
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4634</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12545</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2014-04-04T13:04:24.783747600Z" />
<EventRecordID>108300</EventRecordID>
<Correlation />
<Execution ProcessID="724" ThreadID="756" />
<Channel>Security</Channel>
<Computer>(computer name.domain)</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserSid">S-1-5-21-213254720-224688177-246369</Data>
<Data Name="TargetUserName">(username)</Data>
<Data Name="TargetDomainName">(domain)</Data>
<Data Name="TargetLogonId">0x197ec67</Data>
<Data Name="LogonType">3</Data>
</EventData>
</Event>

Server 2012 R2 RDS – cannot log off user session

We have a 2 server RDS RemoteApp Farm.
One server is constantly leaving user sessions in a disconnected state without the ability to kill the session (rebooting is the only way); this is happing 1-2 times per week.
Servers have been configured to kill a disconnected session after 10 minutes, but some disconnected sessions have been running for days.
Below is a screenshot of the process running for two disconnected users sessions that I could not disconnect, rebooting the server was the only way of fixing this. No error's were generated when users disconnected the session.
Is there a known fix for this?

Hi,
Did you apply session disconnected policy setting in your environment?
There are different ways for getting user log off. As you have commented that it’s happening with specific user, once check whether the user profile is not corrupted or any other related case. Also it might relates that some application or related services
is still running under user profile so that session cannot be logged off. You can also try PowerShell command to log off the user. Also with
Query user command you can find the related session name and ID and then with “Logoff user command” you can logoff the specific user.
For policy related to session setting you can check beneath article. (point 1)
[Forum FAQ] Restrict number of Active Sessions
in RDS 2012 and 2012 R2
Hope it helps!
Thanks.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

User profile images not persisting after log off on Server 2012 R2 RDS Session Hosts

Hi,
We have a 2012 R2 remote desktop deployment, with two session collections, a gateway server, and connection broker.
We have set these session collections to use centralised user profile disks.
What I am having an issue with, is that when a user sets their profile image through the server they have logged on to (I have the desktop experience pack installed so they are able to do this), they can see the user tile has been set with that image in
settings and also on the start menu, but as soon as they log off the server and back on, their profile image has been reset to the default blank image.
I have checked all of my group policy options, and cannot find any settings that could be impacting this.
Does anyone have any ideas why these images are not persisting for users or admins?
Thanks, Eds

Please check that the user is not getting a temporary profile each time he logs in. Also, make sure that the RDP client is properly configured to display the Wallpaper: http://www.webapper.com/blog/index.php/2007/10/18/enabling-desktop-wallpaper-on-remote-desktop-terminal-services/
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Get Active Directory User Last Logon
Create an Active Directory test domain similar to the production one
Management of test accounts in an Active Directory production domain - Part I
Management of test accounts in an Active Directory production domain - Part II
Management of test accounts in an Active Directory production domain - Part III
Reset Active Directory user password

Is there a script or a secure program that I could use to remove profiles after a given user logs off from the system?

I am trying to do this on a network for a specific lab that uses Active Directory. I would like to accomplish this on each individual iMac. The only account that would not be removed after logging off would be the Administrators.
Thanks.

Also, If I created a default profile on each system, could each user log in and be redirected to that profile and all of their network resources be readily available, and once they log out of the system, they are disconnected and all of their information is removed? (Hope this makes sense.)

IPlanet 6.0 SP2 restart on Windows NT when a user logs off the server.

UPDATE: We have found that the iWS 6.0 only restart with JDK 1.3.1 installed for JSP pages. What is the best JDK to use?
iPlanet 6.0 SP2 restart on Windows NT when a user logs off the server. If a admin or joe developer logs into the server (C+A+D) and does what ever... When the
person logs off the NT 4.0 box ... ALL the httpd process restart. We have 80 & 443 & Admin. The processes are running under a user account. Any one have an idea why the process are restarting?"

Hi,
You can use following JDK version for Windows NT.
And please check it out whether WinNT-SP6 as been installed in winNT box.
Window NT:
SDK and JRE 1.4 http://java.sun.com/j2se/1.4/
SDK and JRE 1.3.1_02 http://java.sun.com/j2se/1.3/
SDK and JRE 1.2.2_011 http://java.sun.com/products/jdk/1.2/
JDK and JRE 1.1.8_009
http://java.sun.com/products/jdk/1.1/download-jdk-windows.html
I hope this helps.
Regards,
Dakshin.
Developer Technical Support
Sun Microsystems
http://www.sun.com/developers/support.

Applications still run after user logged off

Hi,
I have a w2k8r2 Terminal server and have a problem that have eluded me for some time now.
When a user is logged off, by either being disconnected or being inactive for a prolonged time, the user initiated programs are still running.
To be more exact, Some times when a user is logged off I have the following situation:
In the task manager on the users tab I cannot see the user anymore (nor in the remote desktop services manager), but in the Processes tab I can still see user initiated programs running. Furthermore I am not able to kill any of those programs, getting an
"Access is denied" error message.
My problem is that when the Terminal Server enters this "state" it becomes all buggy and itchy, causing loads of problems for the users that are already logged in (and for the new ones trying to log in). The only solution I have found is rebooting
the server.
Any solution, or further troubleshooting steps, are more than welcome. For me the next step is reinstalling which I really don't want

1. Check any task schedular is running for application or not,
Refer :
http://answers.microsoft.com/en-us/windows/forum/windows_7-security/if-i-log-off-at-night-leave-computer-on-will/559eec53-1d2a-46f8-ac12-f0d4a32ab57a?msgId=b51d42b3-e727-40c0-b94e-8a01b31bf526
2. Also update Antivirus and scan completely.
3. Is it specific application or all the application, Which user opened in his session?
4. If specific application is running (In this scenario Outlook is running even user logs off), Try the below Citrix forum thread.
Refer :
http://discussions.citrix.com/topic/301644-user-logs-off-process-outlookexe-stays-active-error-the-citrix-server-has-reached-its-concurrent-application-limit/
5. Check and update TCP/IP driver
Refer : http://support.microsoft.com/kb/2465772/en-us
6. Also cross verify Dharmesh suggestions also.
Regards,
Manjunath Sullad

User audit enabled - Only log off

Similar Messages

Maybe you are looking for