RSA Admin

HIPAA Automatic logoff report

Discussion created by RSA Admin Employee on Oct 19, 2009

I had a Windows admin challenge the validity of this report because the eventID covers a variety of events that include but are not limited to the machine automatically logging off because the user forgot to. Is there SQL that I am missing that accounts for this? The below info describes the various events that cause event ID 538 and logon type 3 thanks!

b

 

Interactive logon     Event ID 528     Type 2
    Interactive logoff    Event ID 538     Type 2
    Network logon         Event ID 528     Type 3
    Net Use connection    Event ID 528     Type 3
    Network logoff        Event ID 538     Type 3
    Net use disconnection Event ID 538     Type 3
    Autodisconnect        Event ID 538     Type 3

Outcomes