Auditing ftp users and mapped network drive users in Active Directory and NT4 Domains

["Alexander Bolante" <alexander.bolante () gmail com>]

For auditing purposes, I'm tasked with suspending accounts for users
who have not logged on to AD / NT4 within the past 90 days and
deleting accounts for users who have not logged on to AD / NT4 within
the past 180 days.

I already know I can use logon attribs like lastLogon attrib,
lastLogonTimestamp, etc. in AD / NT4 to decipher when a user last
logged on.

HOWEVER, if a user ftp's or maps to a network drive in AD / NT4, since
that is techincally not a true logon and does not change the flag or
value of any logon attrib, how can I keep track and audit these types
of users?

Cheers!

--
Alexander Bolante | Alexander.Bolante () gmail com

---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------