Audit Account Logon Events

Поделиться
HTML-код
  • Опубликовано: 30 сен 2024
  • This is something I am paying more attention to these days since I started building out my home lab. It's mostly refurbished bare metal devices. I'm slowly going to add some virtual machines and eventually some VMs from one of the Big 3 cloud providers. As an admin you should know what machines you have and whose login is on each. But keeping track of all of those accounts and what they are doing can be difficult to put it mildly. That is why I am looking at scripts in CMD, PowerShell and Bash to make things more manageable. This video covers the exciting world of Auditing. The script in use is to see the number of successful logons and more importantly the failures. Very important in shoring up the cyber kung fu.
    auditpol /set /subcategory:"Logon" /success:enable /failure:enable
    If anyone has a better option or something more detailed (in CMD, PowerShell or Bash). It is appreciated if you choose to share.

Комментарии •