RE: Windows Log

["dave kleiman" <dave () davekleiman com>]

Nick,

There is no way to say when "employees logon/logoff of a PC physically on
the network" unless you are keeping a video log in correlation with a logon
log, that shows the user logging into the workstation.

If you would like to keep track of user-accounts and when that user-account
was utilized to logon the network you could do the following:

First of all you will want understand the Event Id’s, and what each piece of
each event stands for.
For instance the Logon type on Logon failures:

2 'Interactive - Intended for users who will be interactively using the
machine, such as a user being logged on by a terminal server, remote shell,
or similar process.'
3 'Network - Intended for high performance servers to authenticate clear
text passwords. LogonUser does not cache credentials for this logon type.'
4 'Batch - Intended for batch servers, where processes may be executing on
behalf of a user without their direct intervention; or for higher
performance servers that process many clear-text authentication attempts at
a time, such as mail or web servers. LogonUser does not cache credentials
for this logon type.'
5 'Service - Indicates a service-type logon. The account provided must have
the service privilege enabled.'
6 'Proxy - Indicates a proxy-type logon.'
ETC. ETC.


Two good resources for this are:
http://www.microsoft.com/technet/support/ee/ee_advanced.aspx

and

http://www.microsoft.com/downloads/details.aspx?familyid=95A85136-F08F-4B20-
942F-DC9CE56BCD1A&displaylang=en

Now if you want to find out when a workstation was utilized to logon the
domain, you would correlate the workstations log with the DC log.  First
make sure the auditing is on both the workstation and the DC.

You should start by downloading Microsoft® Log Parser:
http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-
91b2-f8d975cf8c07&displaylang=en

Secondly, you might benefit form buying the Microsoft Log Parser Toolkit
book as it covers much of this:
http://www.syngress.com/catalog/?pid=3110


Now we can make a script or 2 and retrieve the information you want.


SELECT
        TimeGenerated AS TimeGenerated,
        TO_LOWERCASE(EXTRACT_TOKEN(Strings,13,'|')) AS SourceAddress,
        TO_LOWERCASE(EXTRACT_TOKEN(Strings,0,'|')) AS User,
        TO_LOWERCASE(EXTRACT_TOKEN(Strings,6,'|')) AS WorkStation,
        TO_LOWERCASE(EXTRACT_TOKEN(Strings,9,'|')) AS CallerDomain,
        CASE TO_INT(EXTRACT_TOKEN(Strings,3,'|'))
                WHEN 2 THEN  '2=Interactive'
                WHEN 3 THEN  '3=Network'
                WHEN 4 THEN  '4=Batch'
                WHEN 5 THEN  '5=Service'
                WHEN 6 THEN  '6=Proxy'
                WHEN 7 THEN  '7=Unlock'
                WHEN 8 THEN  '8=NetworkCleartext'
                WHEN 9 THEN  '9=NewCredentials'
                WHEN 10 THEN '10=RemoteInteractive'
                WHEN 11 THEN '11=CachedInteractive'
                WHEN 13 THEN '13=CachedRemoteInteractive'
                WHEN 14 THEN '14=CachedUnlock'
        END AS Type
INTO SecEvtLogonSuccesTime.csv
FROM security
WHERE EventID IN (540) AND SourceAddress IS NOT NULL
GROUP BY User,SourceAddress,CallerDomain,WorkStation,TimeGenerated,Type
ORDER BY TimeGenerated DESC


Save this to a file “SecEvtLogonSuccesTime.sql”  in the Log Parser
directory.
Run it from the command prompt in the Log Parser directory:
logparser file:SecEvtLogonSuccesTime.sql

It will output SecEvtLogonSuccesTime.csv
Now you all the logons form the DC.
By the way if you look in the event log, the successful logons from network
workstation authenticating to the DC, you will see a 576 followed
immediately by a 540.


Now a script for pulling the logons from the workstations to correlate your
data.
Here you will see a 528 followed immediately by a 576.



SELECT
        TimeGenerated AS TimeGenerated,
        TO_LOWERCASE(EXTRACT_TOKEN(Strings,13,'|')) AS SourceAddress,
        TO_LOWERCASE(EXTRACT_TOKEN(Strings,0,'|')) AS User,
        TO_LOWERCASE(EXTRACT_TOKEN(Strings,6,'|')) AS WorkStation,
        TO_LOWERCASE(EXTRACT_TOKEN(Strings,9,'|')) AS CallerDomain,
        CASE TO_INT(EXTRACT_TOKEN(Strings,3,'|'))
                WHEN 2 THEN  '2=Interactive'
                WHEN 3 THEN  '3=Network'
                WHEN 4 THEN  '4=Batch'
                WHEN 5 THEN  '5=Service'
                WHEN 6 THEN  '6=Proxy'
                WHEN 7 THEN  '7=Unlock'
                WHEN 8 THEN  '8=NetworkCleartext'
                WHEN 9 THEN  '9=NewCredentials'
                WHEN 10 THEN '10=RemoteInteractive'
                WHEN 11 THEN '11=CachedInteractive'
                WHEN 13 THEN '13=CachedRemoteInteractive'
                WHEN 14 THEN '14=CachedUnlock'
        END AS Type
INTO SecEvtLogonSuccesTime_Remote-WS.csv
FROM \\%machine%\security
WHERE EventID IN (528) AND SourceAddress IS NOT NULL
GROUP BY User,SourceAddress,CallerDomain,WorkStation,TimeGenerated,Type
ORDER BY TimeGenerated DESC


Save this to a file “SaveSecEvtLogonSuccesTime_Remote-WS.sql”  in the Log
Parser directory.

Run it from the command prompt in the Log Parser directory:
logparser
file:SecEvtLogonSuccesTime_Remote-WS.sql?machine=THEWORKSTATIONNAME

It will output SecEvtLogonSuccesTime_Remote-WS.csv


Microsoft Log Parser Toolkit:
http://www.syngress.com/catalog/?pid=3110

And

Security Log Management: Identifying Patterns in the Chaos:
http://www.syngress.com/catalog/?pid=3440


If you need to know how to make it into a pretty HTML page with pie charts
etc. the answers our in there.

Additionally, you could come to the CyberCrime Summit:
http://www.southeastcybercrimesummit.com/schedule/SCHEDULE.HTM

I am giving 2 4-hour hands-on advanced Log Parser classes.


Regards,

Dave


______________________________________________________
Dave Kleiman, CAS,CCE,CIFI,CISM,CISSP,ISSAP,ISSMP,MCSE

www.SecurityBreachResponse.com
 




     -----Original Message-----
     From: Nick Duda [mailto:nduda () VistaPrint com]
     Sent: Thursday, January 19, 2006 09:56
     To: security-basics () securityfocus com
     Subject: RE: Windows Log


     To continue this topic, I'm faced with the same thing....

     The problem is that with all these event id's 672, 673,
     540...etc there is still no positive way to say , when a
     user logged on (via cntrl,alt delete) and logged off, as
     in shutdown or log off.
     My goal, is to use syslog or some other form of monitoring
     to keep records of each employees logon/logoff of a PC
     physically on the network. I've been knee deep into all
     these event id's and nothing is accurate.
     Please help.




---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Tailor your education to your own professional goals with degree 
customizations including Emergency Management, Business Continuity Planning, 
Computer Emergency Response Teams, and Digital Investigations. 

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------