Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

need to monitor users logins to WS2008 R2 server

I've been asked to find a way to monitor when users login to a particular WS2008 R2 server. We have a situation where we think a contractor is logging in to the server and making changes. Can I do this with APM and if so what is the best way? Can I use WMI to pulll this info?

Any help would be appreciated greatly....

Find more posts tagged with

Accepted answers

All comments

Hello,
if you have default settings of event logging, Windows security log should contain events for all logins. You can use Windows Event Log Monitor and search for those login events for particular user. Set "Log to Monitor" to "Security", "Match Definition" set to "Custom" and fill required fields to match logon event for specified user.

I would log in using that account, check what events are generated and then setup monitor to match one of them.

Quick Links