Tracking Workstation Logon/Logoff using ADAudit Plus

ADAudit Plus | March 20, 2012 | 2 min read

 

Before getting into the specifics, I would like to give a small introduction on tracking Logon / Logoff in Active Directory environment, which is a cumbersome process.

 

Auditing the Windows Active Directory environment

 

Logon Auditing

 

With the current Windows architecture it’s difficult to get all logon data at a single point. In an AD environment, a Domain Controller (DC) is the one which does the real authentication. When there are multiple DCs in a setup, handling the authentication mechanism, the logon data (please note only the logon data) is available in different computers (read as DCs). So to compute a clear logon activity collecting all these data is essential. Also another pain point here is distinguishing between a user’s real logon (interactive logon) and other types of logons (network, batch, service, unlock, remote-interactive etc.,).

 

The auditing design by Windows is like debug prints, we put in a source code, wherein, when the code encounters the “auditing” setting, then there’s a print on the corresponding activity,

 

if(AUDIT_POL) {
   Debug(“Auth Toke requested for %s”, __user);
}

 

 
Logoff Auditing
 
Logoff auditing is altogether a different territory to conquer; it has nothing to do with the authenticating servers (DCs). In fact, this activity log is never available with the DCs. As it’s a local computer activity, the logoff information is available only with the corresponding Workstation / Server event logs. So, you are forced to gather logoff information from each and every computer on the network. Scalability comes into picture, and so you are driven to an agent oriented methodology, where each agent sits in a workstation, collects and pushes required logoff information to the main server.
 
Let us part from the introduction and proceed to the audit solution.
 
Logon/Logoff via File Server with ADAudit Plus
 
Apart from the AD Change auditing capabilities, ADAudit Plus also has a “File Server” auditing feature, where sh
ares are tracked and reported on File creation/modification/deletion/permission changes etc., One of our customers’ had very intelligently used this feature to compute logon/logoff in his environment.
 
He had put a simple logon script with the following code and assigned it to every user in AD through a GPO,

 

echo logon, %username%, %computername%, Úte%, %time% >> omegalogonlogon.log

 

 
A similar logoff script with the following code, the name of the scripts were “logon.cmd” and “logoff.cmd”
 

 

echo logoff, %username%, %computername%, Úte%, %time% >> omegalogonlogoff.log

Where “omega” is a Server with a share folder called “logon”. In this setting, when a user logs on or logs off, an entry is automatically made into “logon.log” and “logoff.log” respectively.

 
Now using the File Server audit feature, he configured the server “omega” and included the share “logon” for auditing. Thus whenever a user does a logon/logoff, the files “logon.log” and “logoff.log” change; is audited by ADAudit Plus!  The interesting part here is the entry put in the file happens on the user’s credential who is doing the login/logout.  Consequently, username is filled in “who modified” the file in the event log.
 
This enabled our customer to get a report like this,

Track Logon Logoff with ADAudit Plus

 

 

 

ADAudit Plus is capable of collecting logon/logoff information from DCs, Member Servers, File Servers, this workaround is only for Workstations.  The feature to collect the logon information from Workstations is currently under progress and is expected to be released soon.

 

Also if you have any doubts or questions regarding ADAudit Plus you can send us an email to “support@adauditplus.com”

 

Tags : active directory / ADAudit Plus / Domain Controller / File Server / Logoff / Logon / Member Server / Windows Server Auditing / Workstation
balasubramanian@zohocorp.com