Using Logon/Logoff Tracking

Required Settings (Step 3 of 8)

Verify Settings

By clicking on the Logon/Logoff item itself you will see the configuration options for Logon Tracking.

Here you can configure exactly what you would like to monitor, for example you can choose to track all users except for some user accounts.

In order for EventSentry to be able to write logon information to the database, the information must be in the event logs in the first place. As a result, you will need to enable Audit Logon Events in the security policy of every computer where users log on. If this option is not enabled then no logon and logoff events will be generated in the security event logs.

We recommend that you configure this option network-wide in a group policy, but if that is not an option then can set the Requested Audit Policy in the logon tracking package to turn this feature on for you.

Note: Remember that since Windows logs all logon/logoff events of console logins (even when they are domain logons) at the actual workstation where users login. As such, you will need to install the EventSentry agents on all workstations where users you wish to track logon.