Suggestion for capturing user login/logoff, lock/unlock activities

Question

My requirement is to capture user login/logoff, lock/unlock activities with timestamps on Win xp and hp thin client (XP embedded) machines. Currently, I am doing this with windows service which fulfills my requirement but due to some reasons service get stopped (Unable to find the cause) and we loss the data. Second approach I tried is to read the event logs security tab where users above activity get captured. Unfortunately, Win XP doesn't capture the lock event and also logs get cleared when I restart the thin client machine. So this approach also not works for me. Please suggest me the approach/solution to achieve the above requirement or any tools that works for above purpose.

Thanks in advance.

Answer 1

I'm assuming that because you're talking about lock/unlock that your machines are on a domain? The domain controllers have event log entries for lockouts. Be aware that there are different codes on 2003 servers and 2008 servers as the events were 'upgraded'.

It's very hard to work with event logs remotely, so in my opinion a service on the domain controllers, and on each machine that logs to a central web service (or database) is the most reliable approach.

Edit: You could potentially capture logon/logoff events on the domain controllers as well, see this link: http://technet.microsoft.com/en-us/library/cc787567(v=ws.10).aspx

Alternatively you could poll the event logs of these machines from a central source. This wouldn't work well for Domain Controllers because good practice dictates that they only keep event logs for very short periods of time, but it may work for your thin clients. It's far from my preferred solution however as polling takes a long time and you'll run into scaling issues with high numbers of (thin) clients.