ACCOUNT TRACKER FOR PC UPDATE

The session end time (can be obtained using the Event ID 4647) is at 03:02 PM. In the вЂњEvent PropertiesвЂќ given above, a user with the account name вЂњTestUser1вЂќ had logged in on at 2:41 PM. LetвЂ™s use an example to get a better understanding. The session start time is displayed as вЂњLoggedвЂќ. Double-click the event ID 4648 to access вЂњEvent PropertiesвЂќ.Logoff (When an account is successfully logged off) Logon (Whenever an account is successfully logged on)

ACCOUNT TRACKER FOR PC UPDATE

At the вЂњRunвЂќ prompt or in вЂњCommand PromptвЂќ, run the following command to update the group policies.Close вЂњGroup Policy Management ConsoleвЂќ.In вЂњSecurity FilteringвЂќ section in the right pane, click вЂњAddвЂќ to add вЂњEveryoneвЂќ for applying this policy to all Active Directory objects.ДЇigure 2: Group Policy Management Console In вЂњGroup Policy Management ConsoleвЂќ, select the GPO that you have modified.Close вЂњGroup Policy Management EditorвЂќ.Repeat the steps for вЂњAudit LogoffвЂќ and вЂњAudit Other Logon/LogoffвЂќ policies. To audit successful and failed events, click both вЂњSuccessfulвЂќ and вЂњFailureвЂќ checkboxes.Click to select вЂњConfigure the following audit eventsвЂќ.Double-click вЂњAudit LogonвЂќ to access its properties.You have to configure the following policies:.Go to вЂњComputer configurationвЂќ вћ” вЂњPoliciesвЂќ вћ” вЂњWindows SettingsвЂќ вћ” вЂњSecurity SettingsвЂќ вћ” вЂњAdvanced Audit Policy ConfigurationвЂќ вћ” вЂњAudit PoliciesвЂќ вћ” вЂњLogon/LogoffвЂќ.Note: We recommend that you create a new GPO, link it to the domain and edit it. Click вЂњEditвЂќ to access the вЂњGroup Policy Management EditorвЂќ. Under вЂњDomain ControllersвЂќ node, right-click any customized policy.In the вЂњGroup Policy ManagementвЂќ console navigate to вЂњForestвЂќ вћ” вЂњDomainsвЂќ вћ” вЂњ.

Double-click вЂњGroup Policy ManagementвЂќ to open its window.

Go to вЂњStartвЂќ вћ” вЂњAll ProgramsвЂќ вћ” вЂњAdministrative ToolsвЂќ.

Account tracker for pc