0

How would you determine the last FTP logon time/date for a bunch of local user accounts on a DMZ (standalone/workgroup) server running IIS FTP?

I know I could use a log aggregator and sift through it that way, but this server has been operational for approximately 8 years and I don't fancy that vector.

I have also tried the scripting route, but this is of no use because the users have never actually logged onto the machine, so there's no profile (rendering the WMI classes WIN32_UserAccount and WIN32_UserProfile useless). They're just used to access the FTP service.

Thanks in advance

1 Answer 1

1

Assuming that you've got logging set up on the properties of the FTP site you could do it this way:

Presuming you know the usernames, do a search in the FTP log directory for text matching a username. Find the log file with the most current time stamp, search the file for the username from top to bottom, the last entry in the log file will be the last logon time (most current) for that user.

Sounds hokey but it should work.

1
  • It sounds crazy... but it just might work! Cheers!
    – Izzy
    Sep 1, 2009 at 22:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .