Navigation:  Monitoring with EventSentry > Compliance Tracking > Logon Tracking >

Network Logons

With network logon tracking you can collect a wide variety of information about successful and failed logins on your network. Network logon tracking is useful in a variety of scenarios:

For example, the following statistics / reports can be created with the data gathered:

Logon Failure Analysis

This report documents all authentications to domain controllers by users. Note that whenever such a user logs onto their own workstation or member server, this will generate a Network logon to a DC since the user’s workstation must access the domain controller under the user’s credentials to apply Group Policy / User Configuration.

Domain Account Authentication

This report documents all authentications to domain controllers by users. Note that whenever such a user logs onto their own workstation or member server, this will generate a Network logon to a DC since the user’s workstation must access the domain controller under the user’s credentials to apply Group Policy / User Configuration.

User Logon By Server Type

This report documents all logons to monitored servers. It provides the following:

Due to the number of events generated by Windows, this feature may record a large number of events. You can set the "Severity" option to "Audit Failures Only" to reduce the number of events that are captured by this feature. If you are required by law to capture this data, then verify with your compliance officer (and/or audit requirements) to ensure that you can change this setting and still remain compliant.

Perform additional host name or reverse lookup through DNS

When the logon id contained in the logon event (only applies to audit success events) can be linked (correlated) to an earlier logon session, then EventSentry will include the IP address and/or host name. In the case that only the host name or IP address are available, a DNS (reverse) lookup will be performed to gather the missing information.

Due to the nature of DNS lookups, this information might not 100% accurate and should not be solely relied upon.