Reporting Last Interactive Logins Expand / Collapse
Posted 6/28/2012 12:26:41 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 3/26/2012 11:49:05 AM
Posts: 1, Visits: 0
I'm interested in determining when shared/group/service accounts last performed an interactive login in a complete AD environment, and am looking for a tool to extract this.

As I understand the event records a 528 event with Logon type 2 for an interactive login.

What I want to be able to do is run a report, maybe once a day, that collects some last interactive login information (for domain accounts only), and stores it for future analysis/reporting.

I have a reporting tool (WhatsUp Event Analyst) that could be used to scan and collect data, but we have limited skills and resources to run and monitor this, so I'm casting around for something off the shelf that would perform this sort of function, without having to run extracts daily and collect them into a central place and filter them.

Essentially, much like there are reporting tools that gather last login info by trawling all the domain controllers, I'm looking for something that will combine that, with examining collected log info, and give me a Last Interactive Login report.

Any suggestions?

BTW - the issue behind this is proving that there is no inappropriate use of passwords and we're looking at tracking interactive logins as a relatively clean way of demonstrating this.

Post #1045
« Prev Topic | Next Topic »

Permissions Expand / Collapse

All times are GMT -5:00, Time now is 9:19am