This is more of a network question, but since we have so many network / OS gurus who hang out in this forum, I thought this might be a great place to start.

We have been tasked to turn on auditing for logon/logoff for all our local user systems. We manage a network of about 600 workstations, all NT or Windows 2K Pro. Active directory has not been implemented yet. This change might also involve changing the log size if the size is below a minimum (to be determined).

Any thoughts on the best way to approach this? Registry hack? Instantiate a system object and use properties/methods there?

Ideally (going above and beyond customer requirements), I would like to offer a script solution that would do the following from the logon script (or a script called from the logon script):

1. Check during logon to see if auditing for logon/logoff is turned on.

2. Turn on auditing for policy changes.

3. For 1. and 2., if these were off, flag this in the user's logon script log. (In case a user keeps turning it off again.)

4. If the security event log has not been backed up in X days, back it up, clear it, and put an entry into the registry with today's date.

Thanks!

New Mexico Mark

P.S. Did I mention that the customer wants this done last week? (Big surprise there, huh?) That's why I'm scrambling to get advise.

[ 30 April 2002, 22:57: Message edited by: New Mexico Mark ]