Issuing the command, nltest /dbflag:0x20000004 at a command prompt will maintain a log in a folder on the server. The directory is, %systemroot%\debug\netlogon.log. This folder and file are always there but are empty. By running this command, it will track user logon activity and very simple to do and see.

This method doesn't require additional services to be added or a server restart. The log file is always there but always empty. After issuing the command, user logon activity is logged and easier to view than the system or security log in Event Viewer.

To view failed logon attempts issue the command:

findstr /I "0xC0000064" c:\winnt\debug\netlogon.log >> d:\save\failed.txt

This will create a file that will contain only failed logon attempts and from which system they came from. Change the paths to match your system and location you wish to place the output file. The file could be emailed automatically at a scheduled interval using a batch file and Task Scheduler.

When the log grows to 19MB, it's backed up to a netlogon.bak file in the same folder and a new file is created. This is a low maintenance method to track logon attempts to the server to check for inside intruders and scanners that may be running against your desktops or servers trying to find unauthorized access.


Related Link:

• http://desktopsupport.blogs.jcsearch.com/23014/HP_ILO_-_Remote_Tech-Support_Software
  


• 
  How To Track Logon Attempts
  

For more information on the command please download the following document from Microsoft:

http://download.microsoft.com/download/a/8/7/a87526d3-b794-4d93-865a-07c9c2b076e4/TrackNetLogDebug.doc

http://jcsearch.com/blogs/desktopsupport

More Technical Support Recommendations and Reviews:

SimpleTech NAS Storage STI-NAS/500 Reviewed

Related Computer Support and Management Links:

• 
  http://onlineremotesupportsoftware.blogspot.com/
  


• 
  

  Remote Support Software

  
  



• Web Based Remote Support

  
  

Running the command NLTEST on a server to increase computer user tracking is a very inexpensive method to monitor and more importantly have a record of server logins and by whom. A simple command that will make available if and when the time comes that a log or report is needed to possible counter some foul play or a network sever security threat.

I've used this method to increase user tracking and logins and logouts in a domain environement. Although at first there was no need to use the data that it can provide, along came the day when a question came up concerning some questionable actions by one of the users of the network and this information proved to be very helpful.

To add a comment please login by clicking here