Monitor ADFS User logon / logoff events to federated applications

Luis Gonzales 1 Reputation point
2020-02-06T20:40:17.603+00:00

Thanks in advance

I need to audit user logon and logs offs on our applications that use ADFS for federation, but I cannot seems to find any information on how to manage this. here is what I need to do, if a user logs on to one of our applications federated through ADFS we need to log the username, application and time. the application can just point to the trust assigned to the application we can correlate it from there.

if someone know of a good resource on how to accomplish this it would greatly be appreciated.

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,189 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee
    2020-03-28T00:13:39.87+00:00

    The audit configuration depends of the version of your ADFS farm.

    This is a good starting point: https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-logging

    0 comments
  2. Bart Hermans 6 Reputation points
    2020-11-05T11:00:46.657+00:00

    I also had this question.
    My result is a CSV file with all the logon and sign-out activity (and other useful stuff).

    In Eventlog you can rightclick on an event and set "Attach Task to this event". This creates a special scheduled task that will only be triggered when that specific event occurs. In that scheduled task, I start a VBS script that looks for the first event in the Eventlog for that event number. And the result I write in a log file.
    The following events are useful on ADFS : 1200,1201,1203,1206,1210
    The structure of the event (XML) is for the above events all the same, so the script can be used for all 12xx events. So I make use of an argument (which is the number of the event) in the scheduled task that is consumed by my VBS script.
    Its very usefull, because I also send an email for some major problems, or when an account is locked by ADFS with Smartlock.
    On the WAP server I did the same but for other events: 14027,14032,13015,12025,13046,245,396,224
    I shared my VBS code in this post.37716-readeventlogsvbs.txt

    I took the part of my ADFS documentation (about logging) and attached it to this post. PS.: The VBS script is not finished yet completely. For example, in the script you'll find the log file name and location. You must create an empty log file first with the correct name D:\logging\logs\secruitylog.csv37791-logging-and-alerting.pdf

    The scheduled task must run with a user that has specific rights. If you want, I can give you more specifications about that too.37781-readeventlogsvbs.txt