Audit Computer Room Usage

[stebbo]

Hi All,

I need to compile statistics on how frequently the computers in my computer labs are being used. I was thinking of simply counting the number of times there is a login event into each machine. I have about 300 computers spread across 12 labs.

I am not currently a Log Server user but was wondering if this is something that Log Server could do for me or are there other suggestions as to how I could best achieve this. I only need to compile these stats for a 3 month period (at this stage). These are all Windows 7 machines bound to an active directory domain on Windows 2012 R2.

Cheers,
Chris.

[Box293]

Yes, this is something that log Server can do, it's an ideal use case for Log Server.

I did a similar KB article on this for auditing user administrative activity on domain controllers.

https://labs.nagios.com/2015/08/10/moni ... ver-final/

If I'm correct, when a user logs into one of these 300 computers, this information should be recorded on one of the domain controllers. So theoretically you would only need to collect logs from all the domain controllers that these 300 computers use for authentication and you will be able to report on the usage, frequency etc.

Does this help?

[stebbo]

Thanks box,

I shall give that a try.

Cheers,
Chris.

[mcapra]

Let us know if you need additional assistance with the report!

[spurrellian]

This is possible but domain controllers won't log interactive logons of a remote computer

Domain Controllers will log type 3 - Network (i.e. connection to shared folder on this computer from elsewhere on network)

https://www.ultimatewindowssecurity.com ... entID=4624

You would need to install NXLOG on each machine, then run a filter on event ID and logon type 2

I use something similar on Log Server to Report Domain Controller Logons from Remote Desktop

[hsmith]

Thanks for sharing, @spurrellian!