Login script to track users date/time login/logout

Why not use a policy?
HOW TO: Audit User Access of Files, Folders, and Printers in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310399&sd=tech 

 
How to configure your the authenticating server or local machine to log logon events:

START | RUN | gpedit.msc.
Under computer configuration/windows settings/security settings/local policies/audit policy there are several audit policies that should be turned on, like account logon, directory service access, logon events, object access, privelage use, system events.

How to access the audit log file:

The event log you want to retrieve data from the authenticating server is called sysevnt.evt.

Mine is located in %SystemRoot%\System32\Config.

The W2K Resource Kit has an application called “Dump Event Log (DUMPEL)” which dumps event log information into a comma delimited text file.
Example command line for comma delimited file:
c:\program files\resource kit\ dumpel -f audits.txt -l security -m security -c -f d
tucTCISs


DUMPEL Usage:

dumpel -f file [-s \\server] [-l log [-m source]] [-e n1 n2 n3..] [-r] [-t] [-d
x]

    -d <days>        Filters for event last days (number larger than zero)
    -e nn            Filters for event id nn (up to 10 may be specified)
    -f <filename>    Output filename (default stdout)
    -l <name>        Dumps the specified log (system, application, security)
    -b               Dumps a backup file (use -l to specify file name)
    -m <name>        Filters for events logged by name
    -r               Filters out events logged by name (must use -m too)
    -s <servername>  Remote to servername
    -t               Use tab to separate strings (default is space)
    -c               Use comma to separate fields
    -ns              Do not output strings
    -format <fmt>    Specify output format.  Default format is
                       dtTCISucs
                     where
                       t - time
                       d - date
                       T - event type
                       C - event category
                       I - event ID
                       S - event source
                       u - user
                       c - computer
                       s - strings

Retrieve Logon Session Information
Description
Returns information about logon sessions associated with the user currently logged on to a computer.

For more information about the Win32_LogonSession class used in this script, click here.

Supported Platforms

Windows Server 2003 Yes
Windows XP Yes
Windows 2000 No
Windows NT 4.0 No

Script Code

On Error Resume Next
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_LogonSession")
For Each objItem in colItems
    Wscript.Echo "Authentication Package: " & objItem.AuthenticationPackage
    Wscript.Echo "Logon ID: " & objItem.LogonId
    Wscript.Echo "Logon Type: " & objItem.LogonType
    Wscript.Echo "Start Time: " & objItem.StartTime
    Wscript.Echo
Next



 © 2003 Microsoft Corporation. All rights reserved.  

I actually want it to be used like a time clock.  I just want a batch/script type file that is used when a user logs on or off a machine, a file is created/updated on the server the date/time the user logged on/off.

Have you posted this type of question before? I seem to recall someone else wanting this exact same type of system?  

I realize the script above just echo's information back, but you can have it write information to a text file if you want...I've gotten busy for the day, so I haven't had a chance to modify the script above to give you exactly what you want...I need to look at the WMI schema to do that.

Give me some time and I'll come up with something for you.

No, this is my actually my first post.  I registered a while back, so I could post (if needed), but I've usually been able to find my answers before having to post...

I appreciate your efforts.

Gemarti!  Another reason for me to up my budget and get the Resouce Kit!  :)

I have installed Punch Clock software at some of my clients locations:

http://www.punch-clock.com/

It worked fairly well, but I don't know if it will satisfy your needs.

FE

On Error Resume Next
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_ServerSession")
For Each objItem in colItems
    Wscript.Echo "Computer Name: " & objItem.ComputerName
    wscript.Echo "Name: " & objItem.UserName
    Wscript.Echo "Active Time: " & objItem.ActiveTime
Next


Anything I can echo on the screen I can save to a file. Is this more what your looking for?

gemarti,

Could you explain how I would use this?

Re: Comment from Fatal_Exception

I've looked into Punch Clock, but from what I understand, it doesn't work seemlessly with Log On/Off of Machines.  You have to physically Click on the program to have it work.

Copy lines beginning with On Error Resume Next through the line "Next" and paste into a notepad document.
Save with a VBS extension then double click the vbs file; this example will show you your Computer Name, YOur User Name and the amount of time you've logged on. I'm still sifting through the WMI schema to get you exactly what you want.

Gemarti,

Yep, that is why I thought your suggestion a good one.  Copied the code for further use.  

Thanks,

FE

If you do the following, once we get a coupld of scripts built you'll do the following:

START | RUN | GPEDIT.msc
navigate to:
Computer Configuration | Windows Settings | Scripts (Startup/shutdown)

Double click on either Starup or Shutdown
Click ADD
Add the vbs script you need to run. It's that simple.

On Error Resume Next
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_ServerSession")
For Each objItem in colItems
    Wscript.Echo "Computer Name: " & objItem.ComputerName
    wscript.Echo "Name: " & objItem.UserName
    Wscript.Echo "Active Time: " & objItem.ActiveTime
    wscript.Exho "Time: " & Time
Next

Set colItems2 = objWMIService.ExecQuery("Select * from Win32_LocalTime")
For Each objItem in colItems2
    Wscript.Echo "dd-mm-yr: " & objItem.Day & "-" & objItem.Month & "-" & objItem.Year
    Wscript.Echo "Hr:Min: " & objItem.Hour & ":" & objItem.Minute
    Wscript.Echo
Next

Re: Copy lines beginning with On Error Resume Next through the line "Next" and paste into a notepad document....

I tried to copy the text into a .vbs file and when I opened it, nothing happened.  Any thoughts?

Wouldn't you need to compile it first?  Not that I am a programmer, or have the slightest idea what I am doing with it, but I do have the VB6 Enterprise Ed on my other system and can try it.    Guess that is something else I need to learn, but just do not have the time.

FE

OK, since Gemarti has done all the work, here is my 2 cents.  :)

Rename with .vbs extension.
Save in convenient location.
at command prompt type: wsript TimeClock.vbs (from the folder that contains TimeClock.vbs)

FE

You are running XP with IE 6.0 ?


Check this:
START | RUN | Services.msc
Locate:
Windows Management Instrumentation ; make sure it is set to automatic and it is started.

Locate:
WMI Performance Adapter; make sure it is set to automatic and it is started

WMI Performance Adapter:  Just curious, cannot find a 'good' description of what this does.  Got a link?

On my Home PC I had the same experience: Nothing Happened. So I modified the script:

On Error Resume Next

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")


Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem")
For Each objItem in colItems
    Wscript.Echo "Computer Name: " & objItem.Name
    wscript.Echo "Name: " & objItem.UserName

Next

Set colItems2 = objWMIService.ExecQuery("Select * from Win32_LocalTime")
For Each objItem in colItems2
    Wscript.Echo "dd-mm-yr: " & objItem.Day & "-" & objItem.Month & "-" & objItem.Year
    Wscript.Echo "Hr:Min: " & objItem.Hour & ":" & objItem.Minute
    Wscript.Echo

Next

Fatal_Exception: FYI:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/accessing_performance_data_from_a_high_performance_provider.asp

zrockin: Once we have what you want I'll show you how to get the information into a text file.

Re: modified the script...

gemarti,

Windows Management Instrumentation is set to automatic and is started.

WMI Performance Adapter was set to automatic and not started.  I changed this, but the original script did not work.

I modified the script and now it pops up the information in comment boxes.

Now, I'll wait and see how to get it into a text file saved in a mapped or remote directory.

Thanks,
zrockin

Well WMI has proven to be too flaky for this request so...


On Error Resume Next

'++++++++++++++++++++
'Set up variables
'+++++++++++++++++++
dim fso
dim WHSNetwork
dim colItems
dim objWMIService
dim filename

'+++++++++++++++++++++++++
'Setup objects
'+++++++++++++++++++++++++

Set WSHNetwork = WScript.CreateObject("WScript.Network")
set fso = CreateObject("Scripting.FileSystemObject")


'++++++++++++++++++++
'Write text to file
'++++++++++++++++++++
filename = WSHNetwork.username & ".txt"
Set file = fso.CreateTextFile("c:\"& filename,True)

if fso.FileExists("c:\"& filename) then
  Set file = fso.OpenTextFile("c:\" & filename, ForAppending, True)
    file.writeline "Computer Name: " & WSHNetwork.ComputerName
    file.writeline "User Name: " & WSHNetwork.username
    file.writeline "Date: " & Date
    file.writeline "Time: " & Time
    file.writeline vbCRLF
end if

Okay. My final version...

On Error Resume Next

'++++++++++++++++++++
'Set up variables
'+++++++++++++++++++
dim fso
dim WHSNetwork
dim colItems
dim objWMIService
dim filename



'+++++++++++++++++++++++++
'Setup objects
'+++++++++++++++++++++++++

Set WSHNetwork = WScript.CreateObject("WScript.Network")
set fso = CreateObject("Scripting.FileSystemObject")


'++++++++++++++++++++
'Write text to file
'++++++++++++++++++++
filename = "c:\" & WSHNetwork.username & ".txt"
Set file = fso.CreateTextFile("c:\"& filename,True)
Const ForReading = 1, ForWriting = 2, ForAppending = 8
if fso.FileExists(filename) then
  Set file = fso.OpenTextFile(filename, ForAppending, TRUE)
    file.writeline ("Computer Name: " & WSHNetwork.ComputerName & " | " & "User Name: " & WSHNetwork.username &_
    " | " &"Date: " & Date & " | " & "Time: " & Time)
end if

Whoa.  G sure has put the time into this one.  

Not really 5 - 10 minute here and there as I had time. Total time...maybe an hour. Messing with WMI killed most of my time.

gemarti,

What parts of the code do I need to edit for it work for me?

Thanks,
zrockin

Well the trick is to direct the file to the folder you want it to go to. In the line:

>>filename = "c:\" & WSHNetwork.username & ".txt"
Modify the "c:\"   portion to point to the directory you want. If its going to be on a network share then "\\computername\sharename\"   should work.

>>Set file = fso.CreateTextFile("c:\"& filename,True)
Same here, just the "c:\" portion.

BTW you may want to check to see if this file exists before you create it:

so:
if not fileexist(filenme) then
  Set file = fso.CreateTextFile("c:\"& filename,True)
end if

gemarti,

Below is the code I have edited:


On Error Resume Next

'++++++++++++++++++++
'Set up variables
'+++++++++++++++++++
dim fso
dim WHSNetwork
dim colItems
dim objWMIService
dim filename



'+++++++++++++++++++++++++
'Setup objects
'+++++++++++++++++++++++++

Set WSHNetwork = WScript.CreateObject("WScript.Network")
set fso = CreateObject("Scripting.FileSystemObject")


'++++++++++++++++++++
'Write text to file
'++++++++++++++++++++
filename = "c:\Time" & WSHNetwork.username & "zrockin.txt"
Set file = fso.CreateTextFile("c:\Time"& filename,True)
Const ForReading = 1, ForWriting = 2, ForAppending = 8
if fso.FileExists(filename) then
  Set file = fso.OpenTextFile(filename, ForAppending, TRUE)
    file.writeline ("Computer Name: " & WSHNetwork.ComputerName & " | " & "User Name: " & WSHNetwork.username &_
    " | " &"Date: " & Date & " | " & "Time: " & Time)
end if
if not fileexist(filenme) then
  Set file = fso.CreateTextFile("c:\Time"& filename,True)
end if


When I execute it, nothing happens.  Any thoughts?

Thanks,
zrockin

>>filename = "c:\Time" & WSHNetwork.username & "zrockin.txt"

This should be:

"c:\Time\" & WSHNetwork.username & ".txt"

>>Set file = fso.CreateTextFile("c:\Time"& filename,True)

This should be:

Set file = fso.CreateTextFile("c:\time\" & filename, True)


>>if not fileexist(filenme) then
>>  Set file = fso.CreateTextFile("c:\Time"& filename,True)
>>end if

Should be:

if not FileExists(filename) then
  Set file = fso.CreateTextFile("c:\Time\" & filename, True)
end if



You need the \ after the folder name Time.

You also had some typgraphical errors. Windows Scripting isn't very forgiving with these type of syntaxical type errors.

I made the changes below, but still no action:



On Error Resume Next

'++++++++++++++++++++
'Set up variables
'+++++++++++++++++++
dim fso
dim WHSNetwork
dim colItems
dim objWMIService
dim filename



'+++++++++++++++++++++++++
'Setup objects
'+++++++++++++++++++++++++

Set WSHNetwork = WScript.CreateObject("WScript.Network")
set fso = CreateObject("Scripting.FileSystemObject")


'++++++++++++++++++++
'Write text to file
'++++++++++++++++++++
filename = "c:\Time\" & WSHNetwork.username & ".txt"
Set file = fso.CreateTextFile("c:\time\" & filename, True)
Const ForReading = 1, ForWriting = 2, ForAppending = 8
if fso.FileExists(filename) then
  Set file = fso.OpenTextFile(filename, ForAppending, TRUE)
    file.writeline ("Computer Name: " & WSHNetwork.ComputerName & " | " & "User Name: " & WSHNetwork.username &_
    " | " &"Date: " & Date & " | " & "Time: " & Time)
end if
if not FileExists(filename) then
  Set file = fso.CreateTextFile("c:\Time\" & filename, True)
end if

On Error Resume Next

'++++++++++++++++++++
'Set up variables
'+++++++++++++++++++
dim fso
dim WHSNetwork
dim colItems
dim objWMIService
dim filename

'+++++++++++++++++++++++++
'Setup objects
'+++++++++++++++++++++++++

Set WSHNetwork = WScript.CreateObject("WScript.Network")
set fso = CreateObject("Scripting.FileSystemObject")

'+++++++++++++++++++++
'Setup Constants
'+++++++++++++++++++++
Const ForReading = 1, ForWriting = 2, ForAppending = 8

'++++++++++++++++++++
'Write text to file
'++++++++++++++++++++
filename = WSHNetwork.username & ".txt"

if not fso.FileExists("C:\Time\" & filename) then

  Set file = fso.CreateTextFile("c:\Time\"& filename,True)
  file.writeline ("Computer Name: " & WSHNetwork.ComputerName & " | User Name: " & WSHNetwork.UserName & " | Date: " & Date & " | Time: " & Time)
else

  Set file = fso.OpenTextFile("c:\Time\" & filename, ForAppending, TRUE)
  file.writeline ("Computer Name: " & WSHNetwork.ComputerName & " | User Name: " & WSHNetwork.UserName & " | Date: " & Date & " | Time: " & Time)

end if

Allright G, that worked.  You've definately earned the points, but I have one last question to this riddle:

How would I get the text file to distinguish between log on's and log off's?

Thanks,
Z

Follow the information in: Comment from gemarti
Date: 12/04/2003 02:20PM EST
Then have one copy of the script called logon the other log off. In the  file.writeline command put:

file.writeline ("Logging on. ")  

OR

file.writeline("Logging off. ").

Loggoing on Example:

Set file = fso.OpenTextFile("c:\Time\" & filename, ForAppending, TRUE)
  file.writeline ("Logging on. ")
  file.writeline ("Computer Name: " & WSHNetwork.ComputerName & " | User Name: " & WSHNetwork.UserName & " | Date: " & Date & " | Time: " & Time)

I created two .vbs files, one LogOn and one LogOff, each with the corresponding file.writeline in the file.

They are both update the same text file, but only the LogOn file executes the file.writeline.  The LogOff does not.

Any ideas?

FYI..

I deleted the text file and then executed the files the other way (LogOff and then LogOn) and only the LogOff executed the file.writeline and the LogOn did not.

Works for me. Post your LogOn script. Let me see if there are any syntax errors.

Actually G,

I had only put the logon script after the first file.writeline code and not the second, this is why the second entry in the text file did not work.

I fixed it and now it works fine.

Thanks for all your help.

I'm going to load it into Start Up/Shut Down GPC tomorrow and see how it works.

Thanks again.

Great. I always like messing with the scripting tools. Hope everything works out for you.

G ... you sure earned your points here...  :)

zrockin: Your questions VB.Net addressed to me earlier today....

The script above is VBScript...not VB.Net...however:
'lblWelcome' is not declared.
'lnkCompanySite' is not declared.

I suggest you use a DIM statement


DIM lblWelcome
DIM lnkCompanySite

And 'Handled' is not a member of 'System.EventArgs'.

I'm not sure about this. It's all in the context of the application you are writing. I'd have to see the code.

BTW: The email You used just's bounces email to another account I own.
You may get better answers/results if you post in the programming section of this site.

Is there a way I can make this script, post the day of the week, along with the date and time?