How to log network logon and logoff activity?

Posted on 2003-03-11
Medium Priority
Last Modified: 2013-12-04
  As an end result, I would like to have a log that will record when each user logs on to and off of my network.  The kinds of questions I'm going to need to answer are "At what times did Joe Smith logon and logoff on March 5th?
   I know I can use tools like usrstat to see last logon information.  I have also been using auditing to create logon/logoff events in the security log.  For the event log, it seems like every time a user connects to a resource it creates a logon/logoff event.  Oh yeah, and it doesn't say if it's a logon or a logoff, so that really doesn't help me too much.
   Any help or 3rd party software recommendations would be appreciated.
Question by:Dougget
LVL 12

Accepted Solution

trywaredk earned 336 total points
ID: 8114962
You can script Your own record of logons using Windows Scripting Host in or as Your LogonScript:

Dim wshNetwork, sUser
Dim fso, f, outputfile

Set wshNetwork = wScript.CreateObject( "wScript.Network" )
sUser = wshNetwork.username

outputfile = "G:\YourChoise\" & sUser & ".log"

Set fso = CreateObject("Scripting.FileSystemObject")
Set f = fso.OpenTextFile(outputfile, ForWriting, True)

  f.Writeline "LogonTime:  " & Time
  f.Writeline "LogonDate:  " & Date


Set wshNetwork = Nothing


Assisted Solution

MSGeek earned 332 total points
ID: 8115618

Assisted Solution

HO_leg earned 332 total points
ID: 8117470
There is very nice software by LanGuard - Security Event Log Monitor.
This product copies Security Event Logs to central database, produces great reports. You can download trial version.
Good luck!
LVL 12

Expert Comment

ID: 8128418
If You are running W2k-AD-server, then make 2 scripts as I told You above, one for login, and another for logout.

Attach the 2 scripts according to http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B198642

Expert Comment

ID: 9070747
This old question needs to be finalized -- accept an answer, split points, or get a refund.  For information on your options, please click here-> http:/help/closing.jsp#1 
Post your closing recommendations!  No comment means you don't care.

Featured Post

Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
No security measures warrant 100% as a "silver bullet". The truth is we also cannot assume anything but a defensive and vigilance posture. Adopt no trust by default and reveal in assumption. Only assume anonymity or invisibility in the reverse. Safe…
Whether it be Exchange Server Crash Issues, Dirty Shutdown Errors or Failed to mount error, Stellar Phoenix Mailbox Exchange Recovery has always got your back. With the help of its easy to understand user interface and 3 simple steps recovery proced…
How can you see what you are working on when you want to see it while you to save a copy? Add a "Save As" icon to the Quick Access Toolbar, or QAT. That way, when you save a copy of a query, form, report, or other object you are modifying, you…
Suggested Courses
Course of the Month9 days, 22 hours left to enroll

569 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question