Windows networks: why should you monitor login sessions?
Logon session monitoring is being able to say, in real time, who is logged on at which computers and to answer two questions:
- What are all the computers that a given user is currently logged on at?
- Who are the users currently logged on at this particular computer?
There is no way to do that with native Windows functionality, although that would empower System Administrators to efficiently mitigate insider threats.
Instead, what you have to do is figure that out one server at a time.
You can go to a given single Windows server, go to Computer Management > Shared Folders > Sessions, and you can look it up that way.
Think about how difficult that is if you have to check each server individually …
