Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How would you determine the last FTP logon time/date for a bunch of local user accounts on a DMZ (standalone/workgroup) server running IIS FTP?

I know I could use a log aggregator and sift through it that way, but this server has been operational for approximately 8 years and I don't fancy that vector.

I have also tried the scripting route, but this is of no use because the users have never actually logged onto the machine, so there's no profile (rendering the WMI classes *WIN32_UserAccount* and *WIN32_UserProfile* useless). They're just used to access the FTP service.

Thanks in advance

share|improve this question
up vote 1 down vote accepted

Assuming that you've got logging set up on the properties of the FTP site you could do it this way:

Presuming you know the usernames, do a search in the FTP log directory for text matching a username. Find the log file with the most current time stamp, search the file for the username from top to bottom, the last entry in the log file will be the last logon time (most current) for that user.

Sounds hokey but it should work.

share|improve this answer
It sounds crazy... but it just might work! Cheers! – Izzy Sep 1 '09 at 22:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.