1

we have few win xp machines connected to an win2k domain controller. How do I generate a report or view login and logout times from those machines

4 Answers 4

2

If you have the right audit settings on the DC logon events should be recorded in the security log.

Or you could apply a batch file via group policy to the machines you would like to monitor. Obviously this would only log times from the time applied though...

Something like:

Login

echo %logonserver% %username% %computername% %date% %time% >> \file1\logins$\logon.txt

Logout

echo %logonserver% %username% %computername% %date% %time% >> \server\logoff$\logout.txt

Edit as needed.

3
  • The batch file trick you describe is probably the closest you'll come to accuracy without actually parsing the event logs of the client computers. The event logs on the domain controller computers won't be accurate with respect to logoffs and you'll see spurious "logon" events when clients perform periodic group policy refresh. Jul 29, 2010 at 15:18
  • I agree, it's a very clean way to view logon/logoff times.
    – Ethos
    Jul 29, 2010 at 15:21
  • Your script strategy will give you something, but it won't be as accurate or detailed as parsing the client computers' event logs. World-writable files on server computers aren't a realistic "enterprise" strategy. You've also go no provision to detect and account for unexpected shutdowns on client computers. Fast user switching, which works fine on domain member Windows 7 machines, is also going to throw this simplistic strategy for a loop, as well. Jul 29, 2010 at 16:00
1

I believe OldCmp will produce a report on login times. Regardless, the JoeWare tools are incredibly handy, particularly for a pre-2008 domain.

2
  • This is going to show you when the computers have refreshed their domain trust credentials. It won't show the poster anything about logons on those computers. I suppose one could argue that a computer that hasn't refreshed its domain trust credential in 3 months isn't being used for user logons, but I don't think that's what the poster is asking for. Jul 29, 2010 at 15:14
  • Bummer, but at least the other answers have some good reading material. ;) Jul 30, 2010 at 15:25
1

It depends on what you're looking for. I assume you're trying to get a list of times / dates of interactive logons (i.e. user sitting at the computer, user using RDP, etc) from client computers.

To do this, you're going to have to do this by monitoring the client computers. "Logon" and "Logoff", with respect to Windows Server computers and remote connections, isn't like TELNET or SSH sessions. When a user logs-on interactively to the client computer that doesn't open some persistent connection (like a TELNET or SSH session) to a server computer that can be monitored. You'll see logon events on your server computers when users logon to client computers interactively, but you'll have a logoff event on the server computer for a given client due to idle timeout, very likely, before the user actually logs-off of their interactive session on the client computer.

Assuming you're auditing "Logon" events on client computers you could either parse their event logs after-the-fact, or do something like creating an event log sink to monitor interactive logon and logoff events on each client computer and report them back to a central database.

Utimately, monitoring interactive logon times in the event logs of client computers should be fairly reliable. You'll have to watch out for crashes and reboots that might end users' sessions so there would need to be some special-case code to watch out for unexpected restarts (and the functionality to log unexpected shutdowns would need to be turned on... I think it's only on in Windows Server versions, by default).

0

Maybe there is something like "last" as in linux.

1
  • Unfortunately not. Event log parsing or writing scripts to record times in logs are the only viable methods. Jul 29, 2010 at 15:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .