Re: recording users logon/off times

Paul Williams [MVP] wrote:
You can do this via the event logs, but it's a major pain in the ass. You'd be better off implementing your own solution, as the event logs won't cater for unexpected shutdowns, disconnections, etc. and are also sadly lacking in the exact info. you need (due to the way Windows works, it's pretty tough to audit this stuff properly).

One solution is logon and logoff scripts that write to a database somewhere. You can then build logic into reports, etc. for incidents whereby a user logs on from the same computer twice but there's no logoff event (because they hibernated or went into standby).

LimitLogon has done much of this for you. You can, I am sure (although I've not tried), tweak this so that it just reports and doesn't actually limit logons, etc. It's a free download from Microsoft (it's a resource kit add on).


I implemented my own scripts to handle what LimitLogon does now since MS was too stupid to prevent concurrent logons out of the box and so at the time LimitLogon was not available to me. I never integrated my scripts into a DB or anything to keep track of when the logoffs occur since HP OpenView is being used. However the environment at work is a hybrid HP-UX/Windows environment and so that is why that situation was possible.
.

Relevant Pages

  • Re: How would you log logins?
    ... Account logons do ... not have "logoff" events, and are logged on the machine that validated the ... What is the difference between Account Logons or Logon events.? ... >> Administrative Tools, Local Security Policy. ...
    (microsoft.public.win2000.security)
  • RE: xp pro on sbs2k3 forces logoff after logon
    ... to logoff? ... Can you access the event logs from the server using computer ...
    (microsoft.public.windows.server.sbs)
  • Security Event Logs
    ... I have had to read some old NT4 EVT logs and noticed a lot of 528 Logons ... followed in about 2-3 minutes by a 538 logoff... ... Are there any other way for a 528 event to happen other than a CTRL-ALT-DEL ...
    (microsoft.public.windows.server.security)
  • Re: Others users logged on
    ... there is no built-in functionality that would allow you to determine this. ... You can identify recent logons by examining Event logs on all of your DCs - ...
    (microsoft.public.windows.server.general)
  • Re: WMI query to get EventData from event viewer
    ... How Can I Retrieve Information From My Event Logs Regarding Unsuccessful ... Logons? ...
    (microsoft.public.windows.server.scripting)