Isticmaalayaasha badan ee Windows - ka ayaa noo suurtageliyay inaan si ku habboon ugu isticmaalno meelaha dadweynaha sida dugsiyada, kulliyadaha, xafiisyada, iwm. Goobahaas, guud ahaan waxaa jira maamule, kaas oo maareynaya inuu isha ku hayo dhaqdhaqaaqyada isticmaalayaasha ka shaqeeya. Mararka qaarkood, isticmaalayaashu waxay dhaafaan xadkooda oo wax ka beddelaan xisaabaadka lagu habeeyey qaabka Kooxda Shaqada^(Workgroup) . Tani waxay yeelan kartaa saameyn amni, sidaas darteed waa inaan u habeynaa Windows si aan ula soconno dhaqdhaqaaqa isticmaalaha.

Marka loo habeeyo Windows si loola socdo dhaqdhaqaaqyada isticmaalaha, waxaan kordhin karnaa amniga maamulka waxaanan sidoo kale ciqaabi karnaa isticmaalayaasha dhibbanaha anagoo ilaalinayna diiwaanadooda haddii ay dhacdo dembi. Maqaalkan, waxaan kuu sheegi doonaa habka aad ula socon karto dhaqdhaqaaqa isticmaalaha gudaha Windows 11/10/8.1/8/7 adigoo isticmaalaya Siyaasadda Hantidhowrka. Waa kan sida:

Raadraac Hawsha Isticmaalaha^{(Track User Activity)} adigoo isticmaalaya Siyaasadda Hantidhawrka ee Qaabka Kooxda Shaqada^{(WorkGroup Mode)}

1. Riix isku darka Windows Key + R , ku qor secpol.msc gudaha Run  sanduuqa oo ku dhufo Gelida^(Enter) si aad u furto Siyaasadda Amniga Gudaha^{(Local Security Policy)} .

2. Daaqadda ^(2.)Siyaasadda Amniga Gudaha^{(Local Security Policy)} , balaadhi Settings Security^{(Security Settings)} > Siyaasadaha Maxalliga ah^{(Local Policies)} > Siyaasadda Hanti-dhawrka^{(Audit Policy)} . Hadda waa inaad ka dhigtaa daaqadaada mid la mid ah:

3. Shaxda saxda ah, waxaad ku arki kartaa 9 Audit…[] siyaasado ma laha hanti^{(No auditing)} -dhawr sida goob ammaan oo horay loo sii qeexay . ^{(pre-defined)}Mid mid^{(Click one)} u dhufo dhammaan siyaasadaha oo samee doorashada guusha^(Success) iyo guul^(Failure) -darrida , dhagsii Codso^{( Apply)} oo ay ku xigto OK siyaasad kasta.

Sidan, waxaan u habayn doonaa Windows si ay ula socoto dhaqdhaqaaqa isticmaalaha.

Raac tillaabooyinkan si aad u hesho diiwaannada la raadiyay:

Raadraac Dhaqdhaqaaqa Isticmaale Isticmaalka Muuqaalka Dhacdada^{(Trace User Activity Using Event Viewer)}

1. Riix Windows Key + R isku darka, ku qor  Eventvwr in Run  sanduuqa oo ku dhufo Gelida^(Enter) si aad u furto Daawashada Dhacdada^{(Event Viewer)} .

2. Hadda, daaqadda Event Viewe r, oo ka soo baxa dhinaca bidix, ka dooro Windows Logs > Security . Halkan Windows waxay ku haysaa diiwaanka dhacdo kasta oo ku saabsan amniga.

3. Laga soo bilaabo muraayadda dhexe, dhagsii dhacdo kasta si aad u hesho macluumaadkeeda:

Hadda, waa kan liiska aqoonsiga^(IDs) dhacdada kaas oo daboolaya hawlaha adeegsadaha ee xisaabaadka qaabka kooxda shaqada:

1. Abuur Isticmaalaha:^{(Create User:)} Hoos waxaa ku yaal ID-yada dhacdada^{(Event IDs)} ee la galo marka isticmaalaha la sameeyo.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4728 | Nooca:^{(Type: )} Guusha Hantidhawrka | Qaybta:^{(Category: )} Maamulka Kooxda Nabadgelyada | Sharaxaad:^{(Description: )} Xubin ayaa lagu daray koox caalami ah oo awood u leh Ammaanka.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4720 | Nooca:^{(Type: )} Guusha Hantidhawrka | Qaybta:^{(Category: )} Maamulka Xisaabaadka Isticmaalaha | Sharaxaad:^{(Description: )} Koonto isticmaale ayaa la sameeyay

• Aqoonsiga Dhacdada:^{(Event ID: )} 4722 | Nooca:^{(Type: )} Guusha Hantidhawrka | Qaybta:^{(Category: )} Maamulka Xisaabaadka Isticmaalaha | Sharaxaad:^{(Description: )} Koontada isticmaaluhu waa la furay

• Aqoonsiga Dhacdada:^{(Event ID: )} 4738 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta:^{(Category: )} Maamulka Xisaabaadka Isticmaalaha | Sharaxaad:^{(Description: )} Koontada isticmaalaha waa la bedelay.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4732 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Kooxda Nabadgelyada | Sharaxaad:^{(Description: )} Xubin ayaa lagu daray koox maxalli ah oo Amni karti u leh.

2. Delete User: Hoos waxaa ku yaal ID-yada dhacdada^{(Event IDs)} ee la galo marka isticmaaluhu la tirtiro.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4733 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Kooxda Nabadgelyada | Sharaxaad:^{(Description: )} Xubin ayaa laga saaray koox maxalli ah oo Amnigu karti u yeeshay.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4729 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Kooxda Nabadgelyada | Sharaxaad:^{(Description: )} Xubin ayaa lagu daray koox caalami ah oo awood u leh Ammaanka.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4726 | Nooca:^{( Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Xisaabaadka Isticmaalaha | Sharaxaad:^{(Description: )} Koontada isticmaaluhu waa la tirtiray

3. Koontada Isticmaalaha waa Naafada:^{(User Account Disabled: )} Hoos waxaa ah ID-yada dhacdada^{(Event IDs)} ee la galo marka isticmaaluhu uu naafada yahay.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4725 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Xisaabaadka Isticmaalaha | Sharaxaad:^{(Description: )} Koontada isticmaalaha waa la joojiyay

• Aqoonsiga Dhacdada:^{(Event ID: )} 4738 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Xisaabaadka Isticmaalaha | Sharaxaad:^{(Description: )} Koontada isticmaalaha waa la bedelay.

4. Isticmaalaha Koontada waa la furay:^{(User Account Enabled: )} Hoos waxaa ah ID-yada dhacdada^{(Event IDs)} ee la galo marka isticmaaluhu karti yeesho.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4722 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Xisaabaadka Isticmaalaha | Sharaxaad:^{(Description: )} Koontada isticmaaluhu waa la furay

• Aqoonsiga Dhacdada:^{(Event ID: )} 4738 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Xisaabaadka Isticmaalaha | Sharaxaad:^{(Description: )} Koontada isticmaalaha waa la bedelay.

5. Dib u Dajinta Furaha Koontada Isticmaalaha:^{(User Account Password Reset: )} Hoos waxaa ku yaal ID-yada dhacdada^{(Event IDs)} ee la galo marka erayga sirta^{(User Account Password)} ah ee akoontada isticmaaluhu dib loo dajiyo.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4738 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Xisaabaadka Isticmaalaha | Sharaxaad:^{(Description: )} Koontada isticmaalaha waa la bedelay.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4724 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Xisaabaadka Isticmaalaha | Sharaxaad:^{(Description: )} Waxaa la isku dayay in dib loo dajiyo erayga sirta ah ee akoontiga.

6. Dejinta Jidka Xogta Kootada Isticmaalaha: ^{(User Account Profile Path Set: )}Hoos^(Below) waxa ku yaal aqoonsiga dhacdada^{(Event ID)} ee la galo marka Profile Path loo dejiyo akoontada isticmaalaha.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4738 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Xisaabaadka Isticmaalaha | Sharaxaad:^{(Description: )} Koontada isticmaalaha waa la bedelay.

7. Dib u Magacaabida Akoonka Isticmaalaha:^{(User Account Rename: )} Hoos waxaa ku yaal ID-yada dhacdada^{(Event IDs)} ee la galo marka akawnka isticmaalaha^{(User Account)} la badalo.

•  Aqoonsiga Dhacdada:^{(Event ID: )} 4781 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Xisaabaadka Isticmaalaha | Sharaxaad:^{(Description: )} Magaca akoontiga waa la bedelay

• Aqoonsiga Dhacdada:^{(Event ID: )} 4738 | Type: Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Xisaabaadka Isticmaalaha | Sharaxaad:^{(Description: )} Koontada isticmaaluhu waa la bedelay.

8. Samee koox Maxali ah:^{(Create Local Group: )} Hoos waxaa ah ID-yada dhacdada^{(Event IDs)} ee la galo marka kooxda Maxaliga ah^{(Local Group)} la sameeyo .

• Aqoonsiga Dhacdada:^{(Event ID: )} 4731 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Kooxda Nabadgelyada | Sharaxaad:^{(Description: )} Koox maxalli ah oo karti u leh amniga ayaa la sameeyay

• Aqoonsiga Dhacdada:^{(Event ID: )} 4735 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Kooxda Nabadgelyada | Sharaxaad:^{(Description: )} Koox maxalli ah oo awood u leh amniga ayaa la bedelay

9. Kudar Isticmaale Kooxda Maxalliga ah: ^{(Add User to Local Group: )}Hoos^(Below) waxa ku yaal aqoonsiga dhacdada^{(Event ID)} ee la galiyo marka isticmaaluhu lagu daro kooxda maxaliga^(Local) ah.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4732 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Kooxda Nabadgelyada | Sharaxaad:^{(Description: )} Xubin ayaa lagu daray koox maxalli ah oo Amni karti u leh

10. Ka saar Isticmaalaha Kooxda Maxalliga ah: ^{(Remove User from Local Group: )}Hoos^(Below) waxaa ku yaal  aqoonsiga dhacdada^{(Event ID)} ee la galo marka isticmaaluhu laga saaro kooxda Maxalliga^(Local) ah.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4733 | Nooca:^(Type:) Hantidhawrka Guusha | Qaybta:^(Category:)  Maamulka Kooxda Nabadgelyada | Sharaxaad:^{(Description:)} Xubin ayaa laga saaray koox maxalli ah oo Amnigu karti u yeeshay

11. Tirtir Kooxda Maxalliga ah: ^{(Delete Local Group: )}Hoos^(Below) waxaa ku yaal aqoonsiga dhacdada^{(Event ID)} ee la galo marka kooxda Maxalliga ah^{(Local Group)} la tirtiro.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4734 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Kooxda Nabadgelyada | Sharaxaad:^{(Description: )} Koox maxalli ah oo awood u leh amniga waa la tirtiray

12. Magacaabista Kooxda Maxalliga ah:^{(Rename Local Group: )} Hoos waxaa ah ID-yada dhacdada^{(Event IDs)} ee la galo marka kooxda Maxalliga ah^{(Local Group)} la bedelo.

• Aqoonsiga Dhacdada:^{(Event ID: )} 4781 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Xisaabaadka Isticmaalaha | Sharaxaad:^{(Description: )} Magaca akoonka waa la bedelay

• Aqoonsiga Dhacdada:^{(Event ID: )} 4735 | Nooca:^{(Type: )} Hantidhawrka Guusha | Qaybta: ^{(Category: )} Maamulka Kooxda Nabadgelyada | Sharaxaad:^{(Description: )} Koox maxalli ah oo awood u leh amniga ayaa la bedelay

Sidan, waxaad ku raadin kartaa isticmaalayaasha hawlahooda. Maqaalkani wuxuu khuseeyaa Windows 11/10/8.1 ee Habka Kooxda Shaqada^{(Workgroup Mode)} . Hagaha Active Domain^{(Directory Domain)} , nidaamku wuu ka duwanaan doonaa.

How to track User Activity in WorkGroup Mode on Windows 11/10

Multi-user functionality in Windows has enabled us to use it conveniently in public places like schools, colleges, offices, etc. At these places, there is generally an administrator, who manages to keep an eye on the activities of users working therein. Sometimes, users go beyond their limits and modify accounts configured in Workgroup mode. This can have security repercussions, and thus we should configure Windows to track down user activities.

By configuring Windows for monitoring user activities, we can increase the security of the administration and can also punish the victim users by observing their records in case of an offense. In this article, we’ll tell you the way to track user activities in Windows 11/10/8.1/8/7 using Audit Policy. Here is how:

Track User Activity using Audit Policy in WorkGroup Mode

1. Press Windows Key + R combination, type put secpol.msc in Run dialog box and hit Enter to open the Local Security Policy.

2. In the Local Security Policy window, expand Security Settings > Local Policies > Audit Policy. Now you should get your window resembled with this one:

3. In the right pane, you can see 9 Audit…[] policies have No auditing as pre-defined security setting. Click one by one all the policies and make the selection to Success and Failure, click Apply followed by OK for each policy.

In this way, we will have configured Windows to track down user activity.

Follow these steps to get the traced records:

Trace User Activity Using Event Viewer

1. Press Windows Key + R combination, type put eventvwr in Run dialog box and hit Enter to open the Event Viewer.

2. Now, in the Event Viewer window, from the left pane, select Windows Logs > Security. Here Windows keeps a record of every event concerning security.

3. From the center pane, click any event to get its info:

Now, here is the list of the event IDs which covers the user activities for the accounts in the workgroup mode:

1. Create User: Below are the Event IDs that get logged when the user is created.

• Event ID: 4728 | Type: Audit Success | Category: Security Group Management | Description: A member was added to a Security-enabled global group.

• Event ID: 4720 | Type: Audit Success | Category: User Account Management | Description: A User account was created.

• Event ID: 4722 | Type: Audit Success | Category: User Account Management | Description: A User account was enabled.

• Event ID: 4738 | Type: Success Audit | Category: User Account Management | Description: A User account was changed.

• Event ID: 4732 | Type: Success Audit | Category: Security Group Management | Description: A member was added to a Security-enabled local group.

2. Delete User: Below are the Event IDs that get logged when the user is deleted.

• Event ID: 4733 | Type: Success Audit | Category: Security Group Management | Description: A member was removed from a Security-enabled local group.

• Event ID: 4729 | Type: Success Audit | Category: Security Group Management | Description: A member was added to a Security-enabled global group.

• Event ID: 4726 | Type: Success Audit | Category: User Account Management | Description: A User account was deleted.

3. User Account Disabled: Below are the Event IDs that get logged when the user is disabled.

• Event ID: 4725 | Type: Success Audit | Category: User Account Management | Description: A User account was disabled.

• Event ID: 4738 | Type: Success Audit | Category: User Account Management | Description: A User account was changed.

4. User Account Enabled: Below are the Event IDs that get logged when the user is enabled.

• Event ID: 4722 | Type: Success Audit | Category: User Account Management | Description: A User account was enabled.

• Event ID: 4738 | Type: Success Audit | Category: User Account Management | Description: A User account was changed.

5. User Account Password Reset: Below are the Event IDs that get logged when the User Account Password gets reset.

• Event ID: 4738 | Type: Success Audit | Category: User Account Management | Description: A User account was changed.

• Event ID: 4724 | Type: Success Audit | Category: User Account Management | Description: An attempt was made to reset an account’s password.

6. User Account Profile Path Set: Below is the Event ID that gets logged when Profile Path gets set for a user account.

• Event ID: 4738 | Type: Success Audit | Category: User Account Management | Description: A User account was changed.

7. User Account Rename: Below are the Event IDs that get logged when the User Account is renamed.

•  Event ID: 4781 | Type: Success Audit | Category: User Account Management | Description: The name of an account was changed.

• Event ID: 4738 | Type: Success Audit | Category: User Account Management | Description: A User Account was changed.

8. Create Local Group: Below are the Event IDs that get logged when the Local Group is created.

• Event ID: 4731 | Type: Success Audit | Category: Security Group Management | Description: A Security-enabled local group was created

• Event ID: 4735 | Type: Success Audit | Category: Security Group Management | Description: A Security-enabled local group was changed

9. Add User to Local Group: Below is the Event ID that gets logged when the user gets added to the Local group.

• Event ID: 4732 | Type: Success Audit | Category: Security Group Management | Description: A member was added to a Security-enabled local group

10. Remove User from Local Group: Below is the Event ID that gets logged when the user is removed from the Local group.

• Event ID: 4733 | Type: Success Audit | Category: Security Group Management | Description: A member was removed from a Security-enabled local group

11. Delete Local Group: Below is the Event ID that gets logged when the Local Group is deleted.

• Event ID: 4734 | Type: Success Audit | Category: Security Group Management | Description: A Security-enabled local group was deleted

12. Rename Local Group: Below are the Event IDs that get logged when the Local Group is renamed.

• Event ID: 4781 | Type: Success Audit | Category: User Account Management | Description: A name of an account was changed

• Event ID: 4735 | Type: Success Audit | Category: Security Group Management | Description: A Security-enabled local group was changed

In this way, you can trace users with their activities. This article is applicable for Windows 11/10/8.1 in Workgroup Mode. For Active Directory Domain, the procedure will be different.

Related posts

• Tirtir profile-kii hore iyo faylalka si toos ah gudaha Windows 11/10

• Sida loogu daro Tifaftiraha Siyaasadda Kooxda Windows 11/10 Daabacaadda Guriga

• Sida loo sahlo ama loo joojiyo Win32 Wadooyinka Dheer ee Windows 11/10

• Sida loo joojiyo Picture Password-ka xulashada gudaha Windows 11/10

• Sida loo cayimo dhererka PIN ugu yar iyo kan ugu badan gudaha Windows 11/10

• Sida loo damiyo ama loo damiyo qaabka diyaaradda gudaha Windows 11/10

• Xaddid Dejinta Bandwidth Reservable ee gudaha Windows 11/10

• Tilmaamaha Tixraaca Dejinta Siyaasadda Kooxda ee Windows 10

• Siyaasadda Kooxda Background Desktop kuma khusayso gudaha Windows 11/10

• Daaqadaha PC-gu ma seexdo; Qaabka hurdada oo aan shaqaynayn Windows 11/10

• Ka jiheynta boggaga IE una wareeji Microsoft Edge iyadoo la adeegsanayo Siyaasadda Kooxda gudaha Windows 10

• Dami hagaajinta gaarsiinta iyadoo loo marayo Siyaasadda Kooxda ama Tifaftiraha Diiwaangelinta

• Default Logon Picture User Default ee dhammaan isticmaalayaasha gudaha Windows 11/10

• Sida loo tirtiro ku dhex dhisan Akoonka Maamulka gudaha Windows 11/10

• Sida loo Khariideeyo Shabakadda Drive-ka iyadoo la adeegsanayo Siyaasadda Kooxda ee Windows 11/10

• Soo gal Isticmaalaha Maxaliga ah iyo Maamulka Kooxda gudaha Windows 11/10 Guriga

• Sida loo rakibo tifaftiraha Siyaasadda Kooxda (gpedit.msc)

• Demi bandhiga raadinta dhawaanahan ee File Explorer gudaha Windows 11/10

• Habbee Ctrl+Alt+Del Screen addoo isticmaalaya Siyaasadda Kooxda ama Diiwaangelinta Windows

• Khalad markaad furto Tifaftiraha Siyaasadda Kooxda Maxalliga ah gudaha Windows 11/10