How to fetch the user details who are all logged in the server at a particular time

[thahir]

How to fetch the user details who are all logged in the server at a particular time

[jkat54 · Accepted solution]

Use the windows ta to ingest the windows security event log and look for EventCodes 4624, 4634, and 4647.

“Windows Security Log Event ID 4624. This is a highly valuable event since it documents each and every successful attempt to logon to the local computer regardless of logon type, location of the user or type of account. You can tie this event to logoff events 4634 and 4647 using Logon ID” - google result

[richgalloway]

The Splunk server or one monitored by Splunk? What details?

[thahir]

Monitored by splunk

[richgalloway]

What details are you looking for? Are you indexing login and logoff events from the server?

[thahir]

Logoff events from the server

[jkat54]

Windows or Linux?

[thahir]

Windows

[thahir]

Windows