Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any kind of logs per user account, for eg: hours logged in, etc.

Or any kind of third party software's to analyze software usage patterns per user account on Windows Server 2008 R2

share|improve this question
up vote 1 down vote accepted

The logs exist, but they require 3rd party abstraction tools to get at. On individual workstations, if you analyze the Security log you can associate login and logout events to extract a login-duration statistic. The Login/logout events on the Domain Controller are for the individual session that user had with that specific DC, presumably pulling things down like GPOs and other items.

As for software usage, this can also be abstracted out of Windows Eventlogs, but it requires special config and parsing. It requires turning on Process Tracking, and will create VERY large logs on each workstation. You'll then need to extract and analyze those logs to abstract out software usage patterns.

It isn't easy.

share|improve this answer
any third party tools that you would like to recommend – rzlines Sep 15 '10 at 17:52
Seconded. It's difficult enough to be near impossible, unless you can seriously restrict your scope. @rzlines, what problem are you trying to solve? Think of it from the business perspective, not IT. – mfinni Sep 15 '10 at 17:53
@rzlines I don't work with that kind of tool, so don't have any exposure. Splunk (see ads on this site) can do at least the user-login associations, but you'll need to add each and every workstation into its domain. Don't know if it can do the software abstraction you need. It will be VERY expensive. – sysadmin1138 Sep 15 '10 at 17:59
Depending on the scenario - this can be implemented a little easier in a TS/Citrix environment. – mfinni Sep 15 '10 at 19:07
Very true! Run more than one end-user session on the same box, only have to monitor one set of event logs. – sysadmin1138 Sep 15 '10 at 19:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.