hillch
asked on
How to Determine Last Logon date in Workgroup Terminal Servers
How do I tell the last login date for users connecting to a Workgroup Windows 2003 terminal server and a Windows 2000 terminal server? (These servers do not belong to an active directory domain!) Over the years several hundred users have been added to these terminal servers. I could use a method or script to determine the last time a user logged on to a terminal server.
Once I know the last login date I can start to cull out the inactive users.
Thanks
Once I know the last login date I can start to cull out the inactive users.
Thanks
take a look at event manager (right click on my computer)
ASKER
Thank you.
Is Event manager the same as the Event Viewer? I could not locate the Event manager by right clicking on my computer, but could find event viewer in the administration tools.
This was a good idea. The windows 2003 security event logs can export to a csv format file The csv file is in a good format to be searched. The Windows 2000 security event viewer is not so helpful. Its format can not be easily modified so it can be searched.
Well, we are 1/2 way there. I still need a script or procedures to look up the last login date.
Is Event manager the same as the Event Viewer? I could not locate the Event manager by right clicking on my computer, but could find event viewer in the administration tools.
This was a good idea. The windows 2003 security event logs can export to a csv format file The csv file is in a good format to be searched. The Windows 2000 security event viewer is not so helpful. Its format can not be easily modified so it can be searched.
Well, we are 1/2 way there. I still need a script or procedures to look up the last login date.
yes it is event viewer. sorry my mistake. i am unix/linux user so i do not know exact names.
and to scripting: i do not know how to do this on windows, but you can open csv on excel or something and there you can write a formula for sorting data.
You may want to check out Microsoft's LogParser which allows querying/reporting of information from event logs and formatted files.
Download from http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en and install on computer(s)
Start a command prompt via Start | All Programs | Log Parser 2.2 | Log Parser 2.2 (path on XP)
at log parser command prompt (not tested yet since don't have security events on my home machine):
C:\Program Files\Log Parser 2.2> logparser "SELECT MAX(TimeGenerated), SID FROM Security WHERE EventID = 528 GROUP BY SID ORDER BY MAX(TimeGenerated)" i:EVT resolveSIDs:ON
Download from http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en and install on computer(s)
Start a command prompt via Start | All Programs | Log Parser 2.2 | Log Parser 2.2 (path on XP)
at log parser command prompt (not tested yet since don't have security events on my home machine):
C:\Program Files\Log Parser 2.2> logparser "SELECT MAX(TimeGenerated), SID FROM Security WHERE EventID = 528 GROUP BY SID ORDER BY MAX(TimeGenerated)" i:EVT resolveSIDs:ON
Looks like the dashes ended up as special characters in previous post, attached code to hopefully correct.
C:\Program Files\Log Parser 2.2> logparser "SELECT MAX(TimeGenerated), SID FROM Security WHERE EventID = 528 GROUP BY SID ORDER BY MAX(TimeGenerated)" -i:EVT -resolveSIDs:ON
I found a better solution that my previous suggestion which requires that the security event log be present and contain all events from when started. Copy the script from http://www.themssforum.com/VBscripts/Last-logon-190039 and save as LastLogon.vbs, then run from a command line like so:
C:\Work> cscript LastLogon.vbs
and will give output like (if you don't use cscript you will get a dialog popup for every account):
Administrator, 9/9/2007 6:53:23 AM
ASPNET, 6/30/2006 9:18:21 PM
SQLDebugger, <never>
C:\Work> cscript LastLogon.vbs
and will give output like (if you don't use cscript you will get a dialog popup for every account):
Administrator, 9/9/2007 6:53:23 AM
ASPNET, 6/30/2006 9:18:21 PM
SQLDebugger, <never>
ASKER
Thanks for the link. I waited too long and they have removed the script from the site.
Bummer
Bummer
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Mega Thanks