Direct Inward Dialing: +1 408 916 9892
ADAudit Plus is a comprehensive Active Directory auditing solution that will help you monitor, and keep a track of all remote logons and logoffs of your domain users. It will also track events like network disruptions. Using ADAudit Plus, you can track your employees' productivity, who work from home, with intuitive reports.
You can configure these reports to be automatically generated and emailed to you at specified intervals. You can also export these reports to a format of your choice. Here is how you can generate the employee work hour report using ADAudit Plus:
Login to ADAudit Plus → Go to the Reports tab → Under Local Logon-Logoff Reports → navigate to the User Work Hours report
You can also generate reports to track the access of resources on servers. Here is how you can do it using ADAudit Plus:
Login to ADAudit Plus → Go to the File Audit tab → Under File Audit Reports→ navigate to All File or Folder Changes.
With these reports, you can track the actual work hours of your employees even when they are working from home. This could in turn help you in making decisions about your business productivity.
With native AD auditing, here is how you can monitor work hours of employees working from home:
Launch Server Manager in your Windows Server instance.
Under Manage, select Group Policy Management and launch the Group Policy Management console.
Navigate to Forest --> Domain --> Your domain --> Domain Controllers.
Create a new GPO and link it to the domain containing the user object, or edit any existing GPO that is linked to the domain to launch the Group Policy Management Editor.
Navigate to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy.
Under Audit Policy, select Audit logon events and turn auditing on for both success and failure.
Now, navigate to Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> Logon/Logoff.
Under Logon/Logoff, turn on auditing for Audit Logoff, Audit Logon, and Audit Special Logon, for both successes and failures.
Every time a user logs on, logs off, ends a session, locks a system, or unlocks a system, an event log will be recorded in the Event Viewer. These event logs can be used to track employee work hours. To view these audit logs, go to the Event Viewer. Under Windows Logs, select Security. You can find all the audit logs in the middle pane as displayed below.
To filter the event logs to view just the logs associated with employee work hours, select Filter Current Log from the right pane. Simply search for the event IDs 4624 (account was logged on), 4647 (account was logged off), 4634 (logon session end time), 4800 (system was locked), and 4801 (system was unlocked). You can see who logged on, when they logged on, when they logged off, and when the system was locked and unlocked.
Employees who work from home require remote access to the organization's network and resources. Every time a user sets up a remote connection, authenticates, logs on to a session, and launches Explorer Shell successfully, an Event Log will be recorded in the Event Viewer. To view these audit logs, go to the Event Viewer. Under Windows Logs, select Security. You can find all the audit logs in the middle pane as displayed below.
To filter the event logs to view just the logs associated with the remote access of the organization's network for employees who are working from home, select 'Filter Current Log' from the right pane. Simply search for the event IDs 1149 (Remote Desktop Services: user authentication succeeded), 4624 (an account successfully logged on), 4625 (an account failed to log on), 21 (Remote Desktop Services: session logon succeeded), and 22 (Remote Desktop Services: Shell start notification received). You can see the establishment of a network connection to a server from a user RDP client, whether an RDP user has been successfully authenticated on the server or not, whether a local logon is successful, and a successful Explorer Shell start.
Using this information, the productivity of an employee productivity working from home can be computed. You will need to repeat this multiple times if you want to compute the work hours of multiple users.
Native auditing becoming a little too much?
Simplify remote logon activity auditing and reporting with ADAudit Plus.
Get Your Free Trial Fully functional 30-day trial
