How do I log a particular user login event in my active directory

Tobia

6/1/23, 9:40 AM

I have to log a particular "install" user logon in my Active directory. This user has the admin rights to install software and I need to understand where and who is using it.

My first attemp was to create a powershell script to send me a log email triggered by a scheduled task raised with event id 4624 (logon).

The script filters the username to discard all other logins and send the email. To access event viewer data I used a "task user" with required grants.

I had to disable this task because it was triggered by many events, I may say all user and computer logins in my network. For each login the triggered task was raised using the "task user" triggering another logon event. This logon triggers another event and so on...

How can I monitor "install" logins in my network without falling into a storm of log events?

0 + 0

active-directory

logging

scheduled-task

eventviewer

windows-server-2016

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How do I log a particular user login event in my active directory

TH: ฉันจะบันทึกเหตุการณ์การเข้าสู่ระบบของผู้ใช้รายใดรายหนึ่งในไดเรกทอรีที่ใช้งานอยู่ของฉันได้อย่างไร

RO: Cum înregistrez un anumit eveniment de conectare a utilizatorului în directorul meu activ

RU: Как мне зарегистрировать определенное событие входа пользователя в мой активный каталог

VI: Làm cách nào để ghi lại một sự kiện đăng nhập của người dùng cụ thể trong thư mục hoạt động của tôi

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.