Event Viewer Network Logging...

[fr33]

Does event viewer log when computers on the network boot up (when they join the network)?
If so, which node is it under for the event log?
If not, is there a program that can do this?

Thanks

 

[karlsnooks]

fr33,

Use PowerShell to Find Logon Sessions - Hey, Scripting Guy! Blog - Site Home - TechNet Blogs

 

[karlsnooks]

fr33,

If that's a little much, then I've attached a file.

Take that file and remove the .TXT extension and give it a .XML extension,
then import it into Event Viewer.

If you need clarification on any of this, be sure to say so.

View attachment 160296

 

[fr33]

thanks for the link and the xml file karlsnooks!

I'm not familiar with powershell, so I imported your xml file into event viewer.

However, I'm not getting any events logged. So far the other computers to be booted up are XP machines. Windows 7 discovers them and they can be accessed from explorer.
Does this type of logging need anything special? For example the same user account on all computers.

They are already on the same workgroup and network. Every OS is the "home" version, so there are no domains.

 

[karlsnooks]

for one machine, the xml file is good.

for working across a network, then your best bet is using a powershell script. Powershell is very powerful and capable, consequently, mastering of powershell is no small task. There are numerous powershell forums, blogs and books.

 

[fr33]

Hmm, alright, I'll look into using powershell. However, can you please clarify what your event log xml is supposed to record? Since I'm not getting info in the log, I'm not entirely sure...
Is it supposed to record my computer's winlogon events, or the network computers' winlogon events?
Based on my research (technet link), event winlogon event ID 4101 has to do with validating the windows licence?

 

[karlsnooks]

Did you import the "custom view"?

 

[fr33]

yeah, I clicked on "Import custom view", then selected your xml.