Logon Session Times
How to Get User Logon Session Times from the Event Log
To figure out user session time, you’ll first need to enable three advanced audit policies; Audit Logoff, Audit Logon and Audit Other Logon/Logoff Events.
The combination of these three policies get you all of the typical logon/logoff events but also gets the workstation lock/unlock events and even RDP connect/disconnects. This ensures we get all of the session start/stop events.
When these policies are enabled in a GPO and applied to a set of computers, a few different event IDs will begin to be generated. They are:
- Logon – 4624 (Security event log)
- Logoff – 4647 (Security event log)
- Startup – 6005 (System event log)
- RDP Session Reconnect – 4778 (Security event log)
- RDP Session Disconnect – 4779 (Security event log)
- Locked – 4800 (Security event log)
- Unlocked – 4801 (Security event log)
You’ll notice the startup event. Why that one? The reason is because what if the computer’s power plug is pulled while a user is logged in? How will we know when that is. It’s not a perfect metric but it’s the only date/time we have to show when that happened.
Once we’ve got all of the IDs put together, we’ll then need to match the session start event with the very next session end event. But what if there are multiple users logging into a computer? To differentiate we can use the Logon ID field. This is a unique field for each logon session. If we can find a session start time and then look up through the event log for the next session stop time with the same Logon ID we’ve found that user’s total session time.
In this instance, you can see that the LAB\Administrator account had logged in (ID 4624) on 8/27/2015 at 5:28PM with a Logon ID of 0x146FF6. I then looked up through the event log at the subsequent messages until I found a session end event (ID 4634) that showed up with the same Logon ID at 5:30PM on the same day. Knowing this Logon ID, I was then able to deduce that the LAB\Administrator account had been logged on for three minutes or so.
This was just a quick demonstration of actual logon/logoff scenarios. You’ll find that when you review a computer in the “real world” you can’t always depend on logon/logoff events if you’d like to find user session durations. Multiple scenarios may come into play such as when a user locks her computer and comes back to unlock it. Perhaps she may lock her computer and the power gets cut. There will be no unlock event; only a startup event. These are the gotchas you need to watch out for to be able to accurately calculate user session history.
参考博文:
Logon Session Times的更多相关文章
- IIS导入.pfx证书时报错:"A specified logon session does not exist. It may already have been terminated."
在IIS中可以直接导入.pfx文件来给站点绑定https协议: 如果在导入.pfx文件时,不选择"Allow this certificate to be exported"的话 ...
- C#穿透session隔离———Windows服务启动UI交互程序
在Windows服务里面启动其他具有界面的应用程序,需要穿透session隔离,尝试了很多种方法,都可行,现在一一列举下来,并写下几个需要注意的地方. 需要注意的地方 首先要将服务的Account属性 ...
- Audit logon events&Logon type
表一.Logon type 表二.Audit logon events 表三.Logon type details Logon type Logon title Description 2 Inter ...
- System Error Codes
很明显,以下的文字来自微软MSDN 链接http://msdn.microsoft.com/en-us/library/windows/desktop/ms681382(v=vs.85).aspx M ...
- 浅析Windows安全相关的一些概念
Session 我们平常所说的Session是指一次终端登录, 这里的终端登录是指要有自己的显示器和鼠标键盘等, 它包括本地登录和远程登录.在XP时代每次终端登录才会创建一个Session,但是在Vi ...
- Windows Directory ACL Security Check By ACL Baseline
catalog . Windows NTFS ACL(MAC) Permission . How the System Uses ACLs . 服务器不安全ACL配置带来的攻击向量 . NTFS AC ...
- IE下Debug BHO
主要就是修改注册表键值使IE不创建多个进程:HKLM\Software\Microsoft\Internet Explorer\Main - TabProcGrowth 但需要注意的是这种情况下,vs ...
- windows命令行及批处理文件小结
1.命令Shell概述(Command shell overview): The command shell is a separate software program that provides ...
- Windows 错误代码
Error Messages for Windows http://www.gregorybraun.com/MSWINERR.ZIP Server 4.0 Error Messages Code ...
随机推荐
- poj 2391 Ombrophobic Bovines, 最大流, 拆点, 二分, dinic, isap
poj 2391 Ombrophobic Bovines, 最大流, 拆点, 二分 dinic /* * Author: yew1eb * Created Time: 2014年10月31日 星期五 ...
- sql server中Join有几种
JOIN: 如果表中有至少一个匹配,则返回行 (也就是 inner join)LEFT JOIN: 即使右表中没有匹配,也从左表返回所有的行RIGHT JOIN: 即使左表中没有匹配,也从右表返回所有 ...
- js 获取距离顶部的相对高度
getTop (e) { var offset=e.offsetTop; if(e.offsetParent!=null) offset+=this.getTop(e.offsetParent); r ...
- PHPCMS 后台学习
1.final 不能被子类改写,不可扩展2.私有不能被继承3.构造方法,第一个被调用的方法4.static访问 类名::方法名 parent::test();这里test可以不静态 m=模块名& ...
- Jenkins ssh 部署war到tomcat 虚拟目录
1>完成Jenkins服务环境的搭建,此处不再详述,不会的童鞋可参考下面的博客 http://www.cnblogs.com/zz0412/tag/jenkins/ 2>安装Publish ...
- VS2015调用Matlab2017a环境配置(转载)
VS2015调用Matlab2017a环境配置 一定要在Debug+x64平台下进行配置,x64,x64,x64!!!* 1.配置环境变量 右键计算机—–>属性——>高级系统设置——> ...
- Makefile 实例实践
本文为原创文章,转帖需指明该文链接 目录结构如下: comm/inc/apue.h comm/errorhandler.c atexit.c Makefile 文件内容如下: apue.h #if ...
- 大数据(7) - zookeeper的安装与使用
简介 ZooKeeper是一个分布式的,开放源码的分布式应用程序协调服务,是Google的Chubby一个开源的实现,是Hadoop和Hbase的重要组件.它是一个为分布式应用提供一致性服务的软件,提 ...
- 【ATX学习大纲】【ATX基于uiautomator2+Python学习】之Android自动化
github学习地址:https://github.com/openatx/uiautomator2 <_io.TextIOWrapper name='<stderr>' mode= ...
- JQ实现吸顶效果代码
吸顶下过代码跟简单几行代码就可以了 如果滚动的军力大于100,就改变导航的定位方式,否则就默认 $(function(){ $(window).scroll(function(){ ...