Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

we have few win xp machines connected to an win2k domain controller. How do I generate a report or view login and logout times from those machines

share|improve this question

If you have the right audit settings on the DC logon events should be recorded in the security log.

Or you could apply a batch file via group policy to the machines you would like to monitor. Obviously this would only log times from the time applied though...

Something like:


echo %logonserver% %username% %computername% %date% %time% >> \file1\logins$\logon.txt


echo %logonserver% %username% %computername% %date% %time% >> \server\logoff$\logout.txt

Edit as needed.

share|improve this answer
The batch file trick you describe is probably the closest you'll come to accuracy without actually parsing the event logs of the client computers. The event logs on the domain controller computers won't be accurate with respect to logoffs and you'll see spurious "logon" events when clients perform periodic group policy refresh. – Evan Anderson Jul 29 '10 at 15:18
I agree, it's a very clean way to view logon/logoff times. – Ethos Jul 29 '10 at 15:21
Your script strategy will give you something, but it won't be as accurate or detailed as parsing the client computers' event logs. World-writable files on server computers aren't a realistic "enterprise" strategy. You've also go no provision to detect and account for unexpected shutdowns on client computers. Fast user switching, which works fine on domain member Windows 7 machines, is also going to throw this simplistic strategy for a loop, as well. – Evan Anderson Jul 29 '10 at 16:00

I believe OldCmp will produce a report on login times. Regardless, the JoeWare tools are incredibly handy, particularly for a pre-2008 domain.

share|improve this answer
This is going to show you when the computers have refreshed their domain trust credentials. It won't show the poster anything about logons on those computers. I suppose one could argue that a computer that hasn't refreshed its domain trust credential in 3 months isn't being used for user logons, but I don't think that's what the poster is asking for. – Evan Anderson Jul 29 '10 at 15:14
Bummer, but at least the other answers have some good reading material. ;) – Kara Marfia Jul 30 '10 at 15:25

It depends on what you're looking for. I assume you're trying to get a list of times / dates of interactive logons (i.e. user sitting at the computer, user using RDP, etc) from client computers.

To do this, you're going to have to do this by monitoring the client computers. "Logon" and "Logoff", with respect to Windows Server computers and remote connections, isn't like TELNET or SSH sessions. When a user logs-on interactively to the client computer that doesn't open some persistent connection (like a TELNET or SSH session) to a server computer that can be monitored. You'll see logon events on your server computers when users logon to client computers interactively, but you'll have a logoff event on the server computer for a given client due to idle timeout, very likely, before the user actually logs-off of their interactive session on the client computer.

Assuming you're auditing "Logon" events on client computers you could either parse their event logs after-the-fact, or do something like creating an event log sink to monitor interactive logon and logoff events on each client computer and report them back to a central database.

Utimately, monitoring interactive logon times in the event logs of client computers should be fairly reliable. You'll have to watch out for crashes and reboots that might end users' sessions so there would need to be some special-case code to watch out for unexpected restarts (and the functionality to log unexpected shutdowns would need to be turned on... I think it's only on in Windows Server versions, by default).

share|improve this answer

Maybe there is something like "last" as in linux.

share|improve this answer
Unfortunately not. Event log parsing or writing scripts to record times in logs are the only viable methods. – Evan Anderson Jul 29 '10 at 15:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.