Search for a specific user logon (4294391)

To build a search that retrieves a specific user’s login activity over a specific time period:

Note: This scenario uses the Runtime Prompt options to create a generic search definition where you can
then specify the user and time interval each time you run the search.

1. Open the Searches page.

2. In the explorer view (left-hand pane), expand and select the folder where you want to save your search.

• Select the Private folder to create a search that only you can run and view.
• Select the Shared folder to create a search that can be run and viewed by all Change Auditor users.

3. Select the New toolbar button to enable the Search Properties tabs.

4. Open the Info tab and enter the following information:

• Search name: enter a name (e.g., User Logons by Specific User)

• Search description: optionally enter a description for the search

• Search Limit: leave the default setting (50000)

5. Open the Who tab and select the Runtime Prompt check box.
    Note: This allows you to specify the user to be audited each time you run this search.

6. Open the What tab and select the Add | Logons option from the toolbar.

7. On the Add Logons dialog, select one or more of the logon types to be included in the search definition:

• Domain Authentication

• Interactive

• Remote Interactive

• User Session

A: In this scenario, select all the logon types and use the Add button to add them to the Parameter list at the bottom of the dialog.

B. If you only want to return user logon activity events then:

• Select the Search Logons Only check box. 
  Note: This check box is cleared by default, instructing ChangeAuditor to return all ChangeAuditor events that meet the search criteria in addition to user logon activity events.
• Select OK to save your selections and close the dialog.

8. Open the When tab and select the Runtime Prompt check box. This allows you to specify the time interval each time you run this search.

9. Select Run to save and run the search.

10. Since you selected the Runtime Prompt options on both the Who tab and When tab, you will be prompted to specify the user who’s

logon activity you want to audit and the time interval to be searched:

• On the Select Active Directory Object dialog, use the Browse or Search pages to locate one or more users.
• Use the Add button to add the selected user to the list at the bottom of the page.
• Click the Select button to save your selection and close the dialog.
• On the When dialog enter the date range and/or time of day to be searched.
• Click OK to save your selection and close the dialog.

11. A new Search Results page will be displayed populated with the results of your search.