Need SAM template for when user logs into Windows server

NewbyOne

Newby here so bear with me. I am in need of a template to let me know when a user logs into a Windows server and shows who that was. This could be either a local account on the server or a domain account.

I know it could be accomplished using PowerShell or vbscript but neither are my strongpoints.

So essentially, user John.Doe logs into a server, SAM sees it when it polls, then the template would show me "John.Doe" logged in at "06/07/2021 3:46 PM".

Doable?

Any help would be greatly appreciated!!!!

SAM 2020.2.5

chad.every

Is this request simply for a single user or is this all users? 

SAM does have the ability to execute PowerShell scripts, though that is not the route that I would take.

I would make sure you have sufficient audit levels in place enforced through GPOs first. You want that login event stored in the Windows Event Log.

SAM does have a Windows Event Log monitor to look for a specific Event ID with some filtering. You would have to tweak these filters so that the alerts are too noisy.

However, the scenario definitely screams like you're looking for more of a SIEM solution. The Security Event Manager (SEM) from SolarWinds would be the best option here. SEM would allow for real-time notification of user login events without waiting for a polling cycle to kick in. SEM also offers a long term retention if you ever needed to go back in time.

You could also use the Orion Log Analyzer (LA) where you could leverage the Orion Agent and have LA stream Window Events into Orion. Build an alert of when X user logs in and have it kick off a notification. LA would have a much shorter retention (typically 7 days).

LA is typically geared towards troubleshooting while SEM is geared towards security.