Windows 2003 GP Logon/Logoff

Hi,

I have been asked to track when users logon and off of the network. This idea is to see if people are holding their hours and not taking the mickey.

I created a Group Policy auditing "Account Logon Events" and "Require Domain Controller Authentication to Unlock Workstation" on the domain level. I see event in the security log which is great and I understand that there can be a number of events for a logon process because of special permissions etc.

The problem is, I see these event triggered at strange time in the morning and throughout the day for all users. If it was in the day I would not have picked up on it but I know these people are not login on at 1am, 3am, 5am so it seems a little odd and my account activity shows the same behaviour. Is there some kind of authentication check going on at these times? The time between these event are not consistent either. Attached is a picture of my account activity throughout the night.

Is this normal? If so, how can I configure a policy to show interactive logins?

Thanks for any help.

Luke

It looks some kind of time out settings on the system. What I assume that you need appropriate login and logoff time of users acting on the network. When a system is left idle for sometime it goes to sleep mode and to bring it back users login back again. This all stuff is recorded in log, which shows multiple login and logoff times. This means users left the system idle (not working on the same) which lets it to go in sleep mode. This is mostly common in lunch breaks. This can be disabled. I use CPTRAX which works in collaboration with windows server and provides better audit report.