How to keep a track of employees' logon activity?

How to keep a track of employees' logon activity? Free, fully functional 30-day trial
  • With Native AD Auditing

  • With ADAudit Plus

ADAudit Plus is a comprehensive Active Directory auditing solution that will help you monitor, and keep a track of all logons by your domain users. It gives you a powerful and intuitive report to track this.Here is how you can access the employee Logon Activity report using ADAudit Plus:

Login to ADAudit Plus → Go to the Reports tab → Under Local Logon-Logoff Reports → navigate to the Logon Activity report.

  • file access report
    • Some of the details you can get in this report are:
      1. The user name
      2. The domain in which the logon occurred
      3. The IP address of the client used for the logon
      4. The host name of the client
      5. The time at which the logon occurred
    With this report, you can track logons of your employees.

With native auditing, here is how you can monitor employees' logon activities.

  • Step 1: Enable 'Audit logon events' policy
  • Launch Server Manager in your Windows Server instance.

  • Under Manage, select Group Policy Management and launch the Group Policy Management console.

  • Navigate to Forest --> Domain --> Your domain --> Domain Controllers.

  • Create a new GPO and link it to the domain containing the user object, or edit any existing GPO that is linked to the domain to open the 'Group Policy Management Editor'.

  • Navigate to Computer Configuration -> Windows Settings -> Security Settings ->Local Policies -> Audit Policy.

  • Under Audit Policy, select Audit logon events and turn auditing on for success.

  • Step 2: Enable Logon/Logoff auditing
  • Now, navigate to Computer Configuration -> Windows Settings -> Security Settings ->Advanced Audit Policy Configuration -> Audit Policies -> Logon/Logoff.

  • Under Logon/Logoff, turn on auditing for Audit Logon, and Audit Special Logon (Turn on auditing for success).

  • Step 3: Track employee workstation logons in Event Viewer
  • Every time a user logs on, an event log will be recorded in the Event Viewer. To view these audit logs, go to the Event Viewer. Under Windows Logs, select Security. You can find all the audit logs in the middle pane as displayed below.

  • To filter the event logs to view just the logs associated with employee work hours, select Filter Current Log from the right pane. Simply search for the event ID 4624 (account was logged on).

    Using this information, you can track a user's logon activity. You will need to repeat this multiple times if you want to monitor logons of multiple users.

Native auditing becoming a little too much?

Audit logon activities and simplify reporting with ADAudit Plus.

Get Your Free Trial Fully functional 30-day trial

Related How-tos

Request Support


One of our solution experts will get in touch with you shortly.

    Please enter business email address
  • By clicking 'Send Request', you agree to processing of personal data according to the Privacy Policy.

© 2019 Zoho Corp. All rights reserved.