To build a search that retrieves a specific user’s logon activity over a
specific time period:
This scenario uses theRuntime Prompt options to create a generic search
definition where you can then specify the user and time interval each time you
run the search.
1. Open the Searches page.
2. In the explorer view (left-hand pane), expand and select the folder
where you want to save your search.
Select thePrivate folder to create a search that only you can run and
view. Select theShared folder to create a search which can be run
and viewed by all ChangeAuditor users.
3. Select theNew tool bar button to enable the Search Properties tabs.
4. Open the Info tab and enter the following information:
• Search name: enter a name (e.g., User Logons by Specific User)
• Search description: optionally enter a description for the search
• Search Limit: leave default setting (50000)
5. Open the Who tab and select theRuntime Prompt check box. This
allows you to specify the user to be audited each time you run this
6. Open the What tab and select theAdd | Logons option from the tool
7. On the Add Logons dialog, select one or more of the logon types to
be included in the search definition:
• Domain Authentication
• Remote Interactive
• User Session
In this scenario, select all the logon types and use the Addbutton to
add them to the Parameter list at the bottom of the dialog.
If you only want to return user logon activity events, select the
Search Logons Onlycheck box. This check box is cleared by default,
instructing ChangeAuditor to return all ChangeAuditor events that
meet the search criteria in addition to user logon activity events.
SelectOK to save your selections and close the dialog.
8. Open the When tab and select theRuntime Prompt check box. This
allows you to specify the time interval each time you run this search.
9. SelectRun to save and run the search.
10. Since you selected theRuntime Prompt options on both the Who
tab and When tab, you will be prompted to specify the user who’s
logon activity you want to audit and the time interval to be searched:
• On the Select Active Directory Object dialog, use the Browse or
Search pages to locate one or more users. Use theAdd button
to add the selected user to the list at the bottom of the page.
Click theSelect button to save your selection and close the
• On the When dialog enter the date range and/or time of day to
be searched. ClickOK to save your selection and close the
A new Search Results page will be displayed populated with the
results of your search.