i have several servers (VMs, if it makes any difference) running windows 2003 and 2008 server and multiple users that may be logged on to any of those servers at any given time. is it possible to somehow write user logon/logoff events to a log file in windows 2003 and 2008 servers so that i could keep track of it?
thanks.
EDIT - i'd also like to know where (as in ip/hostname) the connections are coming from
They already are (or should be) logged to the Security log.
Event 551 indicates a logoff, whereas Event 4779 indicates a disconnection, rather than a proper logoff.
(All Security Log events.)
Parsing the event log for these events can frankly be a pain in the ass, but at least under 2008, the improved log viewer makes it much easier to filter the EventLog to only show the events you want. Still (and given that you have 2003 servers), it might be worth your time to punch up a Powershell script to parse those values for you... or pay for quality log analyzing/aggregating software.
Below is an example of the log dialogue box you'd see in 2003, though you'd probably want to parse and extract the relevant information into a text format somewhere (which is [relatively] easy with PowerShell).
