Can Windows logoff events be tracked?
- by Massimo
I'm working on an application to track network user logon/logoff events in an Active Directory domain; the application will work by auditing security logs on domain controllers.
Auditing logon events can get somewhat tricky, but it can succesfully be done.
My problem: how can I track logoff events?
Based on some research I've done, it looks like these events are only logged locally on workstations, but not on DCs; also, the "lastLogoff" attribute exists on AD user objects, but it's not actually used by anyone.
This is a very specific question: is something logged on DCs when a user logs off from a domain workstation?
To clarify: I'm not intereseted in other auditing mehods, I can't deploy logon/logoff scripts and I can't install anything anywhere; I also know opened and closed network sessions are logged, but this is not what I'm looking for. I need to audit interactive logons and logoffs to domain workstations, and I can do this by only reading domain controllers security logs; reading each workstation's local event logs is out of question.
If this can't be done, it's ok; but I need a clear answer on that.
Can this be done?
If yes, how?
