How to Track User Logon History in Active Directory
Authored by: Support.com Tech Pro Team
1. Introduction
How to Track User Logon History in Active Directory
2. Step 1: Configure the Audit Policies
Go to “Start†➔ “All Programs†➔ “Administrative Toolsâ€. Double-click “Group Policy Management†to open its window.
In the “Group Policy Management†console navigate to “Forest†➔ “Domains†➔ “www.domain.comâ€.
Under “Domain Controllers†node, right-click any customized policy. Click “Edit†to access the “Group Policy Management Editorâ€.Note: We recommend that you create a new GPO, link it to the domain and edit it.
Double-click “Audit Logon†to access its properties.
Click to select “Configure the following audit eventsâ€.
To audit successful and failed events, click both “Successful†and “Failure†checkboxes.
Click “Apply†and “Okâ€. Repeat the steps for “Audit Logoff†and “Audit Other Logon/Logoff†policies.
Close “Group Policy Management Editorâ€.
In “Group Policy Management Consoleâ€, select the GPO that you have modified. In “Security Filtering†section in the right pane, click “Add†to add “Everyone†for applying this policy to all Active Directory objects.
Figure 2: Group Policy Management Console
Close “Group Policy Management Consoleâ€.
At the “Run†prompt or in “Command Promptâ€, run the following command to update the group policies.gpupdate /force
3. Step 2: Track Active Directory User Login history using Event logs
Perform the following steps in the Event Viewer to track session time:
Go to “Windows Logs†➔ “Securityâ€.
Open “Filter Current Log†on the rightmost pane and set filters for the following Event IDs. You can also search for these event IDs.Event IDDescription4624Logon (Whenever an account is successfully logged on)4647Logoff (When an account is successfully logged off)4634Logon session end time4800System was locked4801System was unlocked
Double-click the event ID 4648 to access “Event Propertiesâ€. The session start time is displayed as “Loggedâ€.
Let’s use an example to get a better understanding. In the “Event Properties†given above, a user with the account name “TestUser1†had logged in on 11/24/2017 at 2:41 PM. The session end time (can be obtained using the Event ID 4647) is 11/24/2017 at 03:02 PM.
.png)
