Log Logins to Windows XP
How to log the logins into WinXP for auditing:
Much more common in our labs are standalone (not part of a domain)
Windows 2000 and Windows XP computers. The procedure for these
computers (based on "Help and Support Center" from Windows XP):
- Log on as an administrator
- Click Start, click Run, type mmc /a (note the space between mmc and /a), and then click OK.
- On the File menu, click Add/Remove Snap-in, and then click Add.
- Under Snap-in, click Group Policy, and then click Add.
- In Select Group Policy Object, click Local Computer, click Finish, click Close, and then click OK.
- At this point, you might want to save this console for further
use. Note you can add multiple snap-in and manage multiple computers
from this console. I find it rather useful myself.
- On the left hand side, navigate to Local Computer Policy >
Computer Configuration > Windows Settings > Security Settings
> Local Policies > Audit Policy
- On the right hand side, double-click "Audit Logon Events"
- Check the boxes for Success and Failure, click OK
- You can close the Microsoft Management Console, though you might want to snoop through the other possible settings first.
Note that if your computer is part of a domain, the settings
for the domain take precedence over those for the local computer, so
you won't be able to set this yourself -- discuss it with your friendly
This document goes into great detail on how to setup logon auditing in a domain setting:
This document clarifies the event id's that will be logged when doing this at a domain level:
>> Leonard Chan's Homepage
>> Scribble Web
>> Log Logins to Windows XP