Monitoring successful logon attempts provides information on the activities of your users, both in a business productivity sense, and from a security perspective. Logon attempts which succeed can yield valuable information too – and can help ensure the continued health of your network infrastructure.

Monitoring logon events is useful not only for failed attempts to gain access, which may indicate malicious attempts to infiltrate your system. Group-defined restrictions of workstations and logon times are also missing, as are enforceable logoffs when allocated logon times have expired.ĭepending on your audit settings, the information recorded by Windows may be dense, cryptic, and poorly documented. In the Windows environment, monitoring of logon sessions, reporting of logons and logoffs, and control of concurrent logins are all absent, as is the remote logoff of sessions on workstations. When a Windows user logs on, there isn’t even a display of their previous logon time. But Netware, UNIX and even the mainframe have the edge, when it comes to basic login session controls. Of the major operating systems, Windows provides the biggest set of security features.

Enterprise network administrators usually implement some security and access control measures over standard user accounts, but may neglect service accounts, which become vulnerable targets.Īs proof against threats from malicious users inside or outside the enterprise – and to comply with regulatory authorities – it’s essential to keep a close eye on what’s happening in your Windows environment by monitoring and auditing user activities over your Windows Server-based network.

Windows monitor user activity