Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for a way to query Active Directory or SMS or something so I can get a list of users who have logged into a Windows server for several servers. It would be like checking the lastlog file on Linux. I don't need the time or anything else except the user name.

Something with an output as simple as: SERVERNAME: shatnerw, nimoyl, kelleyd,

Any input on this would be great. Even if it's "use this function in VB script".

Thanks, ablackhat

Edit: So far I have found the info is in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. It has the guid which is fine. Now I need to figure out a way to query that remotely.

share|improve this question
Knowing the Windows versions you're playing with will be very helpful. There are better ways of doing in 2008/2008r2 than there are in 2000/2003. – sysadmin1138 Dec 16 '10 at 20:03
All of them. Active Directory 2003, but the servers are 2000 through 2008R2. Even if I had to use different processes for each type that would be fine, I simply don't know where to begin and my google-fu is weak today. – ablackhat Dec 16 '10 at 20:21
up vote 1 down vote accepted

If you just want the profile list, PowerShell is probably your best bet.

$Server = 'RemoteServer'
$Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $Server)

This will instantiate $reg as a holder for the remote registry object in HKLM. To get at the bit you want:

$ProfileList = $Reg.OpenSubKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList')

This will populate $ProfileList with the subkeys for the profiles themselves. Then to extract the list of users:

Write-Host "`n$Server: " -nonewline
ForEach ($SID in $ProfileList.GetValueNames()) {
    $ProfileKey = $ProfileList.OpenSubKey($SID)
    # Get the ProfileImagePath key
    # Break the path up into an array, using \ as the delimiter
    $PathBits = $ProfileKey.Split("\")
    # The last element of the array is our user, find the last element
    $LastIndex = $PathBits.Count - 1
    # Dump the last element to something useful
    $User = $PathBits[$LastIndex]
    # Output the user
    write-host " $User" -nonewline

Or something close to that. It's off the top of my head.

share|improve this answer

Create a GPO that applies to the servers you want to monitor and under Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy, enable "Audit logon events" on Success and/or Failure depending on your requirements.

Don't enable Audit account logon events if the servers you are monitoring are DCs. Account logon events are generated on domain controllers when someone logs on with their domain user account so you'll see too many events.

In short, a "Logon event" is created when a user logs on to a computer, an "Account logon event" is created on a domain controller when a user logs on with their domain user account BUT the computer to which they log on to interactively generates an Account logon event too. This is what you want to monitor for. Coupled with EventForwarding (for your capable servers) you can just monitor your own event log or use SNMP traps to catch the events using evntwin.exe and forward them to an SNMP monitoring/alerting system.

On user workstations I actually use a VBScript that opens a hidden IE process to an internal server with PHP/MySQL installed which simply dumps the username in to the database and thats it. The VBScript:

Set oIE = CreateObject("InternetExplorer.Application")
Set oNet = CreateObject("WScript.Network")

sComputerName = oNet.ComputerName
sUsername = oNet.UserName

oIE.Navigate "http://intranet/logon/logon.php?un=" & Trim(sUsername) & "&ma=" & Trim(sComputerName)

Do While oIE.Busy = True

WScript.Sleep 500


Set oIE = Nothing

Obviously you need the web server, PHP and MySQL database to go with this so if it's something you're interested in, let me know and I'll dig those bits out too. You can apply this using a GPO too but with one caveat, it can only run under the User Configuration section of your GPO.

So, two options for you there. HTH.

Edit: Here's the PHP script referred to above. Easy really.

mysql_connect('mysqlserver', 'username', 'password');

$un = trim(addslashes($_GET['un']));
$ma = trim(addslashes($_GET['ma']));

mysql_query("INSERT INTO userlist (user_logon_name, machine_name, logon_time) VALUES ('$un', '$ma', now())");

echo "User ". $_GET['un']. " logged on.";


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.