How to use process monitor to view or log a windows login?

Posted by leeand00 on Server Fault See other posts from Server Fault or by leeand00
Published on 2012-09-28T14:36:05Z Indexed on 2012/09/28 15:40 UTC
Read the original article Hit count: 176

Filed under:

windows-7

|

roaming-profile

|

process-monitor

We're having some issues with Windows 7 Roaming profiles and I was reading here that the login process can be monitored using process monitor.

"There are a couple of ways to configure Process Monitor to record logon operations: one is to use Sysinternals PsExec to launch it in the session 0 so that it survives the logoff and subsequent logon and another is to use the boot logging feature to capture activity from early in the boot, including the logon."

How does one do either of these options using process monitor to find out what is happening during a user login?

© Server Fault or respective owner

Related posts about windows-7

Server 2012 DFS New Member Issue

as seen on Server Fault - Search for 'Server Fault'
I am trying to add a new member to our DFS topology. We have 3 DCs (VMs - VMware) running Windows server 2012, two servers are located in or Primary site and the third at our DR site. Currently the two servers at our primary site are currently replicating DFS (full mesh) and are working fine. I have… >>> More
error in IIS7 but not on IIS6

as seen on Server Fault - Search for 'Server Fault'
I have a website that is we are now deploying to windows 2008 servers that has worked in the past on IIS6 without a problem. It is using .net 2 framework. Most of the website works. Just when we create a screen report over a certain size on the server we get this error. Event code: 3005 Event… >>> More
error in IIS7 but not on IIS6

as seen on Server Fault - Search for 'Server Fault'
I have a website that is we are now deploying to windows 2008 servers that has worked in the past on IIS6 without a problem. It is using .net 2 framework. Most of the website works. Just when we create a screen report over a certain size on the server we get this error. Event code: 3005 Event… >>> More
Microsoft Management Console stops working when I add snap-in to it

as seen on Super User - Search for 'Super User'
I have Windows 7 Ultimate OS. I'm opening mmc.exe as administrator and trying add Certificates or any other snap-in, then while loading that snap-in MMC breaks and displays following message and after that it closes automatically once I click on close button on that message. What could be the problem… >>> More
Handling keyboard and mouse input (Win API)

as seen on Game Development - Search for 'Game Development'
There is a number of ways to catch mouse or keyboard under Windows. So I tried some of them, but every of them has some advantages and drawbacks. I want to ask you: Which method do use? I've tried these: WM_KEYDOWN/WM_KEYUP - Main disadvantage is that, I can't distinguish between left and right-handed… >>> More

Related posts about roaming-profile

Know where the roaming profile is stored in a corporate environment

as seen on Server Fault - Search for 'Server Fault'
Hi, Due to some issue (items reappearing after being deleted), I'd like to check the content of my remotely-stored roaming profile. Is the path stored somewhere locally? I'm not a domain admin, and I don't have direct access to the Active Directory. Thanks! >>> More
Exclude client from sync with roaming profile?

as seen on Server Fault - Search for 'Server Fault'
Hello friends, is it possible to exclude one machine from syncing its profile with the server? The situation is as follows: Our CEO wants to use her semi-private laptop in our network, which means she wants to be able to log in with her account (to be able to access files and all) but does not… >>> More
Windows roaming profile when creating a new user profile

as seen on Server Fault - Search for 'Server Fault'
Hi all, When a particular user is having a lot of problems with Windows XP e.g. applications crashing, unresponsive applications (which used to work), and as a general troubleshooting practice for a domain user, I normally rename that user's old profile and get him/her to logon to create a "fresh"… >>> More
Roaming user profile issues on Server 2008

as seen on Server Fault - Search for 'Server Fault'
I thought I cleared a user's profile from 2008, but it keeps coming back. So, I was looking for the best way to clear a roaming profile in Server 2008, but I have been unable to find anything. But, I did see the post here: http://serverfault.com/questions/18724/user-profile-keeps-loading-temp-profile I… >>> More
Child Folder inheriting a permission that parent folder does not have (NTFS)

as seen on Server Fault - Search for 'Server Fault'
I'm reconfiguring roaming profiles on my network to use proper NTFS security settings according to this article. I have reset the following permissions on the roaming profile parent folder: CREATOR OWNER, Full Control, Subfolder and files only User group with profiles, List folder, Create folders… >>> More