EventLog審計AD獲取用戶IP

Question

應該啓用哪些審計設置才能看到AD登錄用戶的IP地址？

Answer 1

在任何域服務器，在事件日誌中，你可以找到你要的

這裏的信息是用戶登錄事件的「4624」提取和註銷事件「4634」就可以使愨的關係由名爲TargetLogonId的數據發生的事件。 IP地址位於名爲IpAdress的數據中。

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> 
    <System> 
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
    <EventID>4624</EventID> 
    <Version>0</Version> 
    <Level>0</Level> 
    <Task>12544</Task> 
    <Opcode>0</Opcode> 
    <Keywords>0x8020000000000000</Keywords> 
    <TimeCreated SystemTime="2011-05-26T11:09:52.930000000Z" /> 
    <EventRecordID>33354</EventRecordID> 
    <Correlation /> 
    <Execution ProcessID="512" ThreadID="3244" /> 
    <Channel>Security</Channel> 
    <Computer>WM2008R2ENT.dom.fr</Computer> 
    <Security /> 
    </System> 
    <EventData> 
    <Data Name="SubjectUserSid">S-1-0-0</Data> 
    <Data Name="SubjectUserName">-</Data> 
    <Data Name="SubjectDomainName">-</Data> 
    <Data Name="SubjectLogonId">0x0</Data> 
    <Data Name="TargetUserSid">S-1-5-21-314535540-1235592268-145203568-1000</Data> 
    <Data Name="TargetUserName">WM2008R2ENT2$</Data> 
    <Data Name="TargetDomainName">MOD</Data> 
    <Data Name="TargetLogonId">0x6ded7f</Data> 
    <Data Name="LogonType">3</Data> 
    <Data Name="LogonProcessName">Kerberos</Data> 
    <Data Name="AuthenticationPackageName">Kerberos</Data> 
    <Data Name="WorkstationName"> 
    </Data> 
    <Data Name="LogonGuid">{7B3D7A34-80A9-F1B2-CCF1-7F783ED88C28}</Data> 
    <Data Name="TransmittedServices">-</Data> 
    <Data Name="LmPackageName">-</Data> 
    <Data Name="KeyLength">0</Data> 
    <Data Name="ProcessId">0x0</Data> 
    <Data Name="ProcessName">-</Data> 
    <Data Name="IpAddress">192.168.183.101</Data> 
    <Data Name="IpPort">51243</Data> 
    </EventData> 
</Event> 

下面是一個用戶註銷事件的「4634」提取

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> 
- <System> 
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
    <EventID>4634</EventID> 
    <Version>0</Version> 
    <Level>0</Level> 
    <Task>12545</Task> 
    <Opcode>0</Opcode> 
    <Keywords>0x8020000000000000</Keywords> 
    <TimeCreated SystemTime="2011-05-26T11:10:03.070625000Z" /> 
    <EventRecordID>33355</EventRecordID> 
    <Correlation /> 
    <Execution ProcessID="512" ThreadID="3244" /> 
    <Channel>Security</Channel> 
    <Computer>WM2008R2ENT.dom.fr</Computer> 
    <Security /> 
    </System> 
- <EventData> 
    <Data Name="TargetUserSid">S-1-5-21-314535540-1235592268-145203568-1000</Data> 
    <Data Name="TargetUserName">WM2008R2ENT2$</Data> 
    <Data Name="TargetDomainName">MOD</Data> 
    <Data Name="TargetLogonId">0x6ded7f</Data> 
    <Data Name="LogonType">3</Data> 
    </EventData> 
    </Event>