Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to create a log of when people login or logout of computers in a computer lab. My first idea was to just create login/logout scripts that contact a server, but the problem is since these scripts would run as the current user, that they would then be able to run this script outside of these two occasions. Is there any way to go about running a login/logout script as the domain computer rather than as the user?

share|improve this question
You have a problem and a not-working "solution". Which one you would like to fix? – S19N Oct 17 '12 at 23:52
up vote 1 down vote accepted

You're going about this the wrong way, though, at least, you are thinking about it in an enlightened manner.

You want to use the operating system's built-in security logging to do this for you. Users running scripts, as you rightly surmise, can "trick" you. The operating system, assuming the users don't have "Administrator" rights, will provide a true log of user logon / logoff activity.

You don't mention the specific version of Windows your client computers are running. If you're talking about Windows 7 clients you can have an easier time of aggregating the logs from all the machines by forwarding and collecting events. For Windows XP machines you're going to have to collect the events from the clients using a non-stock tool if you want a central log.

You will want an audit policy that enables auditing success (and failure, IMHO) of logon/logoff events on the client computers. I'd recommend using Group Policy to apply this setting. At a most basic level, you should set "Audit logon events" to "Success".

The events you'll need to be watching for in Windows 7 are described by Microsoft here:

For Windows XP this article describes the events.

This isn't as simple as you think, since you may have logons that don't match-up to any logoff if the machine is power-cycled, crashes, etc. You'll need to account for that in your reporting code.

share|improve this answer
Sorry for the late response. I didn't realize what I wanted was so complicated. I appreciate your response, though. I will definitely take a look into what you have said, although since this will take more time to implement than I originally hoped, it won't be for a while. – ptsoccer Nov 9 '12 at 21:29

A logon or logoff scripts runs when a user logs on or off. It makes no sense for it to run as any other account, which is why you're not given that option. While there are workarounds that will allow a script to call another process which in turn runs as another user, they will not give you the results you desire. i.e. No matter how you arrange things, all the users need to do is to run the initial scripts.

If you have users where these things are an issue you have a human/management issue, not a technical one.

share|improve this answer

I want to create a log of when people login or logout of computers

What about using the Windows Security Log?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.