All

Im running a mixed domain of Windows 2000/2003 servers, in 2 domains,
across several sites, in 2 countries, with approx 500 users. I have 1
windows 2000 DC that I would like to use to record audit log info.

I want to audit all logon/logoff events in the domain. Is there a way
to configure this so the events are all logged on this server and not
any of the other DC's. Ive looked at the domain security policy and
this seems to log the logon events to the DC that authenticated the
request (am I wrong?), and our current infrastructure does not allow
for the disk space needed to record logs this way.

Any advice gladly recieved

Thanks

Gary

The authenticating DC will log the event locally. What you could do is
collect the logs into a database at a certain interval and thus keep the log
size fairly small. I'm not sure that this is the best solution though....

Regards,
/Jimmy
--
Jimmy Andersson, Q Advice AB
Microsoft MVP - Directory Services
---------- www.qadvice.com ----------


"Gary Watt" <gary.watt@jeyes.co.uk> wrote in message
news:41dbfbed.0502070815.43ad134b@posting.google.c om...

Thanks

yep. It looks like that gonna have to be it. Unfortunately, most of
the servers were setup pre-me joining the company, and are upgrades
from NT4 with only 4Gb C partitions. Ill have to see if I can move the
logs to another drive where i have some room.

Do you know if I can import the logs to a spreadsheet? one reason i
wanted each server to log to a single location was so I could review
the logs quickly for the info I need (I only want to use it to locate
unused user & computer accounts) and i dont really want to have to
check numerous logs. If I could load all the logs into a single
spreadsheet, I could still manage to do this.

Thanks again

Gary






"Jimmy Andersson [MVP]" <jimmy_NO_SPAM_@mvps.org> wrote in message news:<OXvSEETDFHA.1932@TK2MSFTNGP14.phx.gbl>...

When you save the logfiles you can choose to save them as .csv files if you
want. Also, check out Log Parser 2.2 which you can find at
www.microsoft.com/downloads.

Regards,
/Jimmy
--
Jimmy Andersson, Q Advice AB
Microsoft MVP - Directory Services
---------- www.qadvice.com ----------


"Gary Watt" <gary.watt@jeyes.co.uk> wrote in message
news:41dbfbed.0502080742.315ac1ab@posting.google.c om...