To build a search that retrieves a specific user’s login activity over a specific time period:
Note: This scenario uses the Runtime Prompt options to create a generic search definition where you can
then specify the user and time interval each time you run the search.
1. Open the Searches page.
2. In the explorer view (left-hand pane), expand and select the folder where you want to save your search.
3. Select the New toolbar button to enable the Search Properties tabs.
4. Open the Info tab and enter the following information:
• Search name: enter a name (e.g., User Logons by Specific User)
• Search description: optionally enter a description for the search
• Search Limit: leave the default setting (50000)
5. Open the Who tab and select the Runtime Prompt check box.
Note: This allows you to specify the user to be audited each time you run this search.
6. Open the What tab and select the Add | Logons option from the toolbar.
7. On the Add Logons dialog, select one or more of the logon types to be included in the search definition:
• Domain Authentication
• Interactive
• Remote Interactive
• User Session
A: In this scenario, select all the logon types and use the Add button to add them to the Parameter list at the bottom of the dialog.
B. If you only want to return user logon activity events then:
8. Open the When tab and select the Runtime Prompt check box. This allows you to specify the time interval each time you run this search.
9. Select Run to save and run the search.
10. Since you selected the Runtime Prompt options on both the Who tab and When tab, you will be prompted to specify the user who’s
logon activity you want to audit and the time interval to be searched:
11. A new Search Results page will be displayed populated with the results of your search.
© ALL RIGHTS RESERVED. Feedback Nutzungsbedingungen Datenschutz Cookie Preference Center