Can't find what you're looking for? Access our previous PDF-based library.
9 min read
️ Updated Oct 19, 20261. Introduction
This guide takes you through the necessary steps to enable the auditing of logon/logoff events. In both agentless and agent-based auditing, the following steps must be completed:
Generate Logon.exe from the software, while adding or modifying the domain, and create a Group Policy on the server to assign it. It will collect logon and logoff events and passes them to Logon/Logoff Audit Module.
Install Logon/Logoff Audit Module on any of the domain controllers of the domain, which will process logon/logoff events and send it to the software for display.
Both modules should run continuously at the server for collecting logon/logoff events. The following items will not be generated if the above steps are not performed.
Successful User Logon/Logoff and Domain Controller Logon/Logoff Reports
Custom Reports, LiveFeed, alerts, and scheduled reports for above reports
2. Issue
If you have neither installed Logon/Logoff Audit Module nor generated logon.exe nor linked it with the server, the following error appears onscreen while generating Successful User Logon/Logoff or Domain Controller Logon/Logoff.
You will need to generate logon.exe, link it with a Group Policy, and install Logon/Logoff Audit Module to enable the auditing of logon/logoff events to fix this issue.
3. Manage Logon/Logoff Audit Module
The steps to install, manage, and uninstall the logon/logoff Audit Module are listed here.
3.2 Install Logon/Logoff Audit Module
To audit logon/logoff events, you will need to install the Lepide Data Security Platform Logon/Logoff Audit Module on any of the domain controllers of the domain to collect logon/logoff events. The installer file for this module will come with setup file, which you can download from https://www.lepide.com/Lepide Data Security Platform/download.html. After downloading this installer file, execute the following steps to install the Logon/Logoff Audit Module.
Double-click the downloaded installer file to start the installation.
Click Next to proceed to the next step of the license agreement.
It is recommended to read the license agreement carefully before installing the software.
If you agree to the license agreement and want to continue with the installation, check I accept the agreement and click Next.
The next step lets you customize the location of the shortcuts folder in the Start Menu.
Click Browse and select a different location to modify the location of the shortcuts folder in the Start Menu.
Click Next to use the default or customized shortcuts folder.
Check the boxes titled Create a desktop icon and/or Create a Quick Launch icon, if you want.
Click Next to proceed further. The software is now ready to be installed.
Click Install to begin the installation procedure.
Once installed, the following page comes in the wizard. It asks for the login credentials of a user having administrative privileges.
Enter the login credentials of a local administrator, domain administrator or a Managed Service Account object on this page. Leave the password text box blank when you select to enter the name of a Managed Service Account object.
Click Next after entering the login credentials of an administrator. The next page displays the message of successful installation of the module.
NOTE: You should use any of the following accounts or objects:
A local system administrator
A member of Domain Admins Group
Manage Service Account object
Click Finish to complete the process.
3.2 Stop Logon/Logoff Module
You may have to stop the app server either to stop receiving logon/logoff events or to uninstall the Module. Perform the following steps.
Go to Start Menu → Administrative Tools → Services to access the services.
Locate Lepide Logon Logoff Service. Right-click on it to access the context menu.
Click Stop to stop the service.
3.3 Uninstall Logon/Logoff Audit Module
Execute the following steps.
There are two ways to start the uninstallation.
Go to Start → All Programs → Lepide Data Security Platform Logon/Logoff Audit Module, click Uninstall Lepide Data Security Platform Logon/Logoff Audit Module.
Go to Start → Control Panel → Add/Remove Programs or Programs. Select Lepide Data Security Platform Logon/Logoff Audit Module and click Remove.
Following any of the above methods displays a warning message.
Click Yes to uninstall the module. After completing the uninstallation, the message box appears.
Click OK to complete the process.
4. Generate Logon.exe file
Perform the following steps on software to generate logon.exe file.
Use any of the following methods to start with this process.
While adding a domain with Advanced Configuration, you arrive at the following step.
In domain properties, go to Object Class and Other Settings to access the following settings.
Check Audit Successful User Logon/Logoff option.
Click
icon to access the following dialog box.
Enter the IP Address of the domain controller, where Logon/Logoff Audit Module has been installed.
Click the
icon to select the location on the server to the save this executable file.
It is recommended to save the executable file in the shared folder on the server, of which logon/logoff events you want to monitor.
Select the folder.
Click OK to go back to the previous dialog box, which now shows the selected folder.
Click OK to generate and save the executable file to the specified location. The following message appears on the screen to confirm the same.
Click hyperlink titled Please follow the link to know the steps to be performed at the server. It opens an HTML file in the default Web Browser.
5. Create Group Policy Object at Server
Execute the steps below at the domain, of which logon/logoff monitoring you want to enable.
Go to Start Menu → All Programs → Administrative Tools → Group Policy Management. It opens Group Policy Management.
In the left panel, expand the nodes to reach the node of the domain controller.
Right click on the node of the domain to access the following context menu.
Select the option Create a GPO in this domain, and Link here.... It displays the following dialog box to create a new Group Policy Object (GPO).
Provide a name for the new Group Policy e.g. Logon Logoff by Lepide Data Security Platform.
Click OK. It creates the new GPO and shows it in the Group Policy Management.
Right-click newly created GPO.
Click Edit to access Group Policy Management Editor console.
In the left panel, go to Logon Logoff by Lepide Data Security Platform → User Configuration → Policies → Windows Settings → Scripts (Logon/Logoff)". It displays two policies – Logon and Logoff in the Right Panel.
Here, you have to modify any of these two policies. In this test case, we are modifying the logon policy.
Double-click Logon policy in the Right Panel to access the following dialog box.
Click Add on this tab. It displays the following box to add a script.
Click Browse in this new box. Leave this box opened up as it is.
Open the shared folder where you have copied the Logon.exe script file. Copy it.
Paste this file logon.exe in the folder section of the Browse window.
Select the file and click Open. It opens the file and takes you back to the Add a Script box, which now displays the selected file.
Click OK. It takes you back to the Logon Properties.
Click Apply and OK to apply the changes.
By default, this logon.exe is set to run late during the system startup. The steps to avoid this delay are explained in the following methods.
Steps for Windows Server 2016 and Windows Server 2012 R2:
The following steps are required to remove the delay in running logon.exe:
In the same Group Policy Management Editor, go to Computer Configuration → Policies → Administrative Templates → System. Select Group Policy node under System. It shows all the sub-policies in the right panel:
Double-click Configure Logon Script Delay to access its properties.
Click Enabled.
Enter the value as 1 to run the logon scripts after one minute of the logon.
Click Apply and OK.
Steps for Windows Server 2008 R2, Windows Server 2008, Windows Server 2012:
It is required to perform the following steps to remove this delay in running logon.exe.
In the same Group Policy Management Editor, go to Computer Configuration → Policies → Administrative Templates → System. Select Scripts node under System. It shows all the sub-policies in the right panel.
Double-click Maximum wait time for Group Policy Scripts to access its properties.
NOTE: In Windows Server 2012, this policy is available as Specify Maximum wait time for Group Policy Scripts.
Click Enabled.
Enter the value for seconds. The idle value is 1 second.
Click Apply and OK.
Close Group Policy Management Editor console.
Come back to Group Policy Management console.
Select the newly created/modified policy in the Left Panel. It shows its details in the Right Panel.
In its Right Panel, the Security Filtering section lets you select the objects such as users, groups, and computers on which this policy will be applied.
Click Add to display the box to add the objects upon which this policy will be applicable.
Type Everyone in the text box and click Check Names. It selects all objects.
Click OK to confirm the change. It takes you back to the Group Policy Management window, which now displays the newly added object.
Close the Group Policy Management console.
Go to Run or Command Prompt and type the command gpupdate.
Press Enter to run the gpupdate command to update the group policies.
You will need to logoff the current user and then logon again in the Windows Server to run the logon.exe file.
You can follow the above steps to enable both the collection of logon/logoff events and to generate relevant reports, alerts, and LiveFeed updates.