Navigation:  Web Reports > Compliance Tracking > Logon Tracking >

Console Logons

 Top  Previous  Next

If you have configured Logon Tracking to write to the database then you can run queries to search for logon information on the Logon Tracking page.

 

The Logon Tracking page offers the following information:

 

•Which users are currently logged on to the network, and where
•How long was a particular user logged on over a period of time
•Which user logged on through Terminal Services, which through the console
•Other logon reports

 

Pencil and Document 24 n g Prerequisites:

A Tracking Package that includes a Logon Tracking object needs to be assigned to one or more computers for logon tracking data to be written to the database.

 

Computer, Domain, Username

By selecting one or more of the above fields, only logons matching your selection will be displayed. If you select the exclamation mark next to your selection, then only logons not matching your selection will be displayed.

 

From, To

You can restrict your search to a particular time and/or date range. You can click the calendar icon to bring up a calendar. When you set a date range using the From and/or To fields, any limit setting (e.g. "last week") will be ignored.

 

Order By

Use this field to sort your output. By default, output is sorted descending by Date and Time.

 

Logon ID, Logon Type

Only show logons with the specified logon ID (you may enter a partial Logon ID) or logon type. EventSentry currently distinguishes between Console and Terminal Services logon types.

 

Duration

Only show logons that lasted for the specified amount of time

 

Incomplete Data

Lines shown in orange indicate that the exact logoff time is not known which happens when Windows® does not record a logoff in the event log. In this case, EventSentry has no way of knowing when a user has logged off and will assume that a user has logged off, for example when the computer is shut down or when the user logs on again.

 

Group By

You can group output by selecting one or more (hold the CTRL key while selecting multiple) fields from the "Group By" box.

 

Show Chart

Selecting the "Show Chart" option will display a graphical chart in addition to the text report. A pie chart is shown if you group by one field, a stacked column chart is displayed when you group by two fields. Grouping by more than two fields will not show a chart.

 

clip0292

 

Alert or Warning 1 24 n g

You can click on any Logon ID to immediately display all the processes that were launched from the specified logon. Process Tracking needs to be activated in order for this feature to work.

 

 

Weekly Reports

This option organizes logon events collected during the selected week and totals them based on user. It will combine all available logon values by each user for each day which can total more than 24-hours. The Weekly Reports also total the daily average and the percentage of console logon events versus terminal logon events. The option is available to view in the web browser or can be exported to CSV.