log in times

Hello,

is there some way I can see when someone logs in to the network? We are using windows 2003 server with AD.
msh069Asked:
Who is Participating?
 
bank_on_itConnect With a Mentor Commented:
Check out this article.
http://www.windowsecurity.com/articles/Windows-Active-Directory-Auditing.html

This link will inlighten you the subject matter
http://technet.microsoft.com/en-us/library/cc787176(WS.10).aspx

Check out the various categories on the left!
0
 
JoltinJoeConnect With a Mentor Commented:
If you need a real-time alert, a recurring script or service would have to be written.  But if looking up the last logon time of a user would suffice, Windows 2003 AD replicates an attribute called lastLogonTimestamp.  This can be viewed with advanced tools like LDP or ADSIEdit, but you can also get a new tab in your "Active Directory Users and Computers" if you register a DLL called acctinfo.dll available in the Windows 2003 Resource Kit - downloaded from: http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en.  You could also install Account Lockout and Management Tools to get the DLL - http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=7af2e69c-91f3-4e63-8629-b999adde0b9e.

The new tab the DLL makes available includes things like last logon time, last bad logon against a particular dc, user SID, etc.

I hear there might be a bug in acctinfo.dll though resulting in an incorrect last logon time being displayed.  If you find that the information is indeed incorrect in your environment, there is an unreleased but improved acctinfo2.dll floating around the internet you might be able to track down.
0
 
arnoldConnect With a Mentor Commented:
GPO login script .bat:
@echo
echo on %DATE% %TIME%, %USERNAME% logged in on %COMPUTERNAME% using %LOGONSERVER% server to authenticate connecting on %SESSIONNAME% >> \\server\share\logon_logoff.txt

Creating the same as a logout script will work the same way. A record will not be present if the system powers off (hard).  no logout porcess started/used.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.