I audit across multiple sites during a login script. Most of my offices have T1's or Cable. I don't have a DC in every site as well, and it still works pretty well.
I use the following in my login script to make sure that the systems only get audited once a day. Also if you don't want a computer to get audited I have added a line for that as well. I don't let it audit my backup, SQL, or exchange server as I don't want to increase the loads on those boxes as they get hit pretty hard. Figured this might help.
:OA FOR /f "tokens=2,3,4 delims=-/.: " %%F IN ("%DATE%") DO SET FORMATTED_DATE=%%F-%%G-%%H if exist %temp%\OpenAudIT_%FORMATTED_DATE%.LOG goto next if %computername% == BACKUP goto next if %computername% == Exchange goto next if %computername% == SQL goto next call %windir%\system32\cscript.exe //t:400 //nologo %0\..\OA\audit.vbs > %temp%\OpenAudIT_%FORMATTED_DATE%.LOG
|