Appendix: GFI EventsManager
Default Reports

Account Usage Reports

Successful logons grouped by users

Screenshot 46 - Sample report showing Successful logons grouped by users

	Username
	List of events showing all successful logons by a specific user.

 

Use this report to:

•	Generate a list of all successful user logons, grouped by user

•	Monitor all access to network resources.

 

 

Successful logons grouped by computers

Screenshot 47 - Sample report showing Successful logons grouped by computers

	Computer name
	List of events showing all successful logons on a specific computer. Events are grouped by computer, providing an overview of the logon activity in each domain.

 

Use this report to:

•	Generate a list of all successful user logons, grouped by computer

•	Monitor all access to network resources.

 

Failed logons

Screenshot 48 - Sample report showing Failed logons

List of events showing all failed logons, including user account and reason for failure

 

 

Use this report to:

•	Generate a list of all failed logons

•	Investigate multiple logon failures.

NOTE 1: Logon failure due to a disabled account may signal attempted abuse by former internal users, such as ex-employees.

NOTE 2: Logon failure due to account expiry may signal attempted abuse by contractors or temporary internal users.

Logoff events

Screenshot 49 - Sample report showing Logoff events

List of events showing all user logoff events. Correlate these events with the successful logon events to determine the duration of each user session.

 

Use this report to:

•	Generate a list of all user logoff events

•	Determine the duration of a user session.

Account Logons

Screenshot 50 - Sample report showing account logons

 

	List showing the NTLM logon attempts
	List showing the Kerberos authentication ticket requests
	List showing the Kerberos service ticket requests
	List showing the Kerberos failed events
	List showing the Terminal Services account logon events

 

 

 

 

 

Use this report to:

•	Generate a list of all system logons.

Account lockouts

Screenshot 51 - Sample report showing Account lockouts

List of events showing all user accounts which have been locked out

 

Use this report to:

•	Generate a list of all user accounts which have been locked out

•	Identify possible attacks against the default Administrator account.

Successful logon count on each computer

Screenshot 52 - Sample report showing Successful logon count on each computer

	Chart displaying the distribution of successful logon events by user on a specific computer
	Computer name
	List of events showing all successful user logon events on a specific computer

 

 

Use this report to:

•	Graphically represent successful logons by users on each computer

•	Generate statistical information of successful logons by users on each domain / computer.