This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Audit logon events

Hello,

I would like to know if there is a way to use InTrust in order to have reporting for user logon. To my understanding the way to do it is to configure a gather of the security log either on the DCs or the servers and workstations or on all of them. Searching about this was confusing because i couldn't find a clear enough image on what i have to configure on the domain through gpo in order to audit the info username xxxxx logon to xxxxxx at xxxxxxx.

I understand that it is not so much of an InTrust question but more of an AD one but if someone have implemented this and can provide feedback it will be much appreciated.

Thank you.

0 JohnnyQuest over 5 years ago

Auditing logons can be a major pain.

The event I think you want to look for is ID 4624

Here's a good description of this event here:

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4624

PS This event will get logged as long as you enable Audit Logon Events:

(this is an older article but you get the point)

docs.microsoft.com/.../dd941635(v=ws.10)

Hope this helps.
Cancel
Up 0 Down

Cancel
0 Alexandros Marioleas over 5 years ago in reply to JohnnyQuest

That is the problem. By enabling Audit Logon Events and Audit Account Logon Events you get a lot of event IDs such as 4624 or 4648 with hundreds of entries for each ID most of them useless because they are from system accounts or not showing a username. And i am struggling to understand if there is a way to get a nice report with users and when and where they have logged on.
Cancel
Up 0 Down

Cancel
0 JohnnyQuest over 5 years ago in reply to Alexandros Marioleas

This is where the "science" of event reporting comes in. You must go through an exercise of analyzing a "raw" list of returned events to come to an understanding of what is "normal" for your environment which will then help you to determine what events you consider to be of "high value" and which ones you can filter out of your reports. It is an iterative process. What are you planning to use to produce your reports? - i.e. are you going to create a custom report in the Knowledge Portal or perhaps export data from the Repository Viewer?
Cancel
Up 0 Down

Cancel
0 Aidar.Karabalaev over 5 years ago

About 10 years ago the situation was the following. AD MSFT native DC Security Log with appropriate Audit Policy turned on probably will generate 128MB/0.5-1h for 10K user AD with 95%+ "noise" events and 2-3% useful ones. Therefore the issue is large volume of events and finding exactly what to report on: what can be asked + what you want = Best Practices. I recommend to contact PSO to target the goal in most efficient way.
Cancel
Up 0 Down

Cancel
0 Alexandros Marioleas over 5 years ago

Thank you guys for your answers. I'll try to find out how to do it.
Cancel
Up 0 Down

Cancel
0 JohnnyQuest over 5 years ago in reply to Alexandros Marioleas

If you are running a fairly recent version of InTrust, the Repository Viewer offers "searches" that are very much like reports and can indeed be "converted" into Reports in the same UI. I would first make sure you are collecting the events you need and then take a look at what is available in the Repository viewer.
Cancel
Up 0 Down

Cancel
0 Sergey.Goncharenko over 5 years ago

Here is a great material from one of our solutions architect that can help with identifying correct events https://www.quest.com/whitepaper/top-3-workstation-logs-to-monitor8132498/
Cancel
Up 0 Down

Cancel
0 Alexandros Marioleas over 5 years ago in reply to Sergey.Goncharenko

Thank you Sergey. Indeed it's great material.
Cancel
Up 0 Down

Cancel