[Urgent]Access log of Windows Server 2016

Question

Hello.

I would like to know how to get the access log of windows server 2016.

Users access the server via active directory id.

I am trying to get the access log of specific ID.

I tried event log, but the log seems dont show the access by AD's ID.

Or, Please tell me how to use [Get-UalServerUser] in this specific case.

Thank you for your help.

Post script:

I tried "Get-UalUserAccess", but no prompt was returned.

Answer 1

Hello

To get the access log of a specific ID on Windows Server 2016, you can use the Event Viewer. The log files are stored in the C:\Windows\System32\winevt\logs folder. You can view these logs through the Event Viewer, which can be opened through the MMC, or through the Start menu by selecting All apps, Windows Administrative Tools, followed by Event Viewer.

Regarding the Get-UalServerUser command, I couldn’t find any specific information about this command. It seems like there might be a misunderstanding as the available commands are Get-UalServerDevice and Get-UalDailyUserAccess, which are used to get User Access Logging (UAL) records for client requests, by device, and by user for services on a server, respectively.

As for the Get-UalUserAccess command, it gets User Access Logging (UAL) records for client requests, by user, for services on a server. If you’re not getting any output from this command, it could be due to a variety of reasons. Here’s an example of how to use it:

Get-UalUserAccess -Username "domain\username"

This command gets the UAL records for a client user with a specified name. If you’re still not getting any output, it might be worth checking if the User Access Logging service is running. You can use the Get-Service UALSVC PowerShell cmdlet to retrieve information about the UAL Service including whether it is running or stopped and whether it is enabled or disabled.