Hi,
I have been asked to track when users logon and off of the network. This idea is to see if people are holding their hours and not taking the mickey.
I created a Group Policy auditing "Account Logon Events" and "Require Domain Controller Authentication to Unlock Workstation" on the domain level. I see event in the security log which is great and I understand that there can be a number of events for a logon process because of special permissions etc.
The problem is, I see these event triggered at strange time in the morning and throughout the day for all users. If it was in the day I would not have picked up on it but I know these people are not login on at 1am, 3am, 5am so it seems a little odd and my account activity shows the same behaviour. Is there some kind of authentication check going on at these times? The time between these event are not consistent either. Attached is a picture of my account activity throughout the night.
Is this normal? If so, how can I configure a policy to show interactive logins?
Thanks for any help.
Luke
Bookmarks