Checking User Login Times

cburris52001 used Ask the Experts™
Hello experts,

We are having an issue with some workers possibly fibbing on their time sheets. We dont have time clocks, so we'd like to use computer login's as "check up" on what time the user actually came in.

If at all possible we'd like to be able to view a log on what time the user logged into the domain. If there is any way to display this, we'll tell the staff that they need to login to their computers first thing when they arrive in the mornings as we will check this to confirm their time sheets and if they don't log in, we can assume they are lying on their time sheets.

Sorry for bringing in the office side with the tech side, but it's something my bosses ask if we could do!
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2013
You could go through event logs but that could be a pain if you don't have event log management software.  A simple login/logoff script could be helpful

Do yo all have badges to come in and out of the office?  I've seen those logs used too.



ADmanager plus is good tool & its reporting is also superb.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!


Do you know of a good freeware event log viewer? We don't have badges at that office.

I found AD Manager this morning, but I can't find anything that will list logins. I see the option to search for the past 90 days, but it only lists one day when I choose that option, are you familiar with how to get it to show more than one login?
Top Expert 2013

Microsoft makes event comb can search logs from several DCs,

If you suspect one or two dishonest users you can just use the script and only apply it
to them.


You can create additional tabs in active directory to monitor last logon and logoff times.

It also tells you a lot of information you might want to know about your systems and clients.

I love this little trick:::
I use a quick/dirty inventory script that I wrote to gather information from PC's on login.  I just add this script to login via group policy and when users' login it writes the information to a file. The only drawback is that users have to have permission to read/write to the file.

You could also modify the script real easily to make it a .csv and just change the delimiter (" | ") to "," and bingo..  In my scenario I have this run and at the end of the day a scheduled task runs to rename and file and move to a different directory and rename with the date so I have a daily log of who is logging into to what computers..

The output looks like this:
3/24/2010 1:10:03 AM | IP Address: 192.168.XXX.XX  | Mac Address: 00:XX:00:XX:00:XX | Domain: DOMAIN  | Username: username  | Computer Name: COMPUTERNAME | Win Ver: 5.1.2600 | Service Tag: ABCD2E1 | Computer Model: OptiPlex 755

It's free, it's simple, easy to modify... tells you who's logging in to what and has come in handy for lots of purposes...

' Script to get various information from computer and write to file

strComputer = "."

Dim objShell : Set objShell = WScript.CreateObject("Wscript.Shell")
Dim objWMI : Set objWMI = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Dim colSettingsComp : Set colSettings = objWMI.ExecQuery("Select * from Win32_ComputerSystem")
Dim colSettingsBios : Set colSettingsBios = objWMI.ExecQuery("Select * from Win32_BIOS")
Dim ObjWMIService : Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Dim colSettingsIP : Set colSettingsIP = objWMIService.ExecQuery("Select * From Win32_NetworkAdapterConfiguration Where IPEnabled = True")
Dim objFso : Set objFso = CreateObject("Scripting.FileSystemObject")
Dim WshNetwork : Set WshNetwork = CreateObject("WScript.Network")
Dim colSettingsOS : Set colSettingsOS = objWMIService.ExecQuery ("Select * from Win32_OperatingSystem")
Dim strDirectory, strFile, objitem, objComputer, strModel, strSerial, strOS, strVer, MACAddress

strDirectory = "\\SERVERNAME\LogDirectory"

strFile = "\log.txt"
strComputerName = wshNetwork.ComputerName
strUserDomain = objShell.ExpandEnvironmentStrings( "%USERDOMAIN%" )
strUser = WshNetwork.UserName
strCount = 1

For Each objComputer in colSettings
  strModel = objComputer.Model

For Each objComputer in colSettingsBios
  strSerial = objComputer.SerialNumber

 For Each objOperatingSystem in colSettingsOS
  strOS = objOperatingSystem.Name
  strVer = objOperatingSystem.Version

For Each objitem in colSettingsIP
    If strCount = 1 Then
        strIPAddress = Join(objitem.IPAddress, ",")
		MACAddress = objitem.MACAddress
        IP = stripaddress
        strCount = strCount + 1

		Const ForAppending = 8
Set objTextFile = objFSO.OpenTextFile _
(strDirectory & strFile, ForAppending, True)
objTextFile.WriteLine(Date & " " & Time & " | " & "IP Address: " & IP & " | " & "Mac Address: " & MACAddress & " | " & "Domain: " & strUserDomain & " | " &  "Username: " & strUser & " | " & "Computer Name: " & strComputerName & " | " & "Win Ver: " & strVer & " | " & "Service Tag: " & strSerial & " | "  & "Computer Model: " & strModel)

End If

Open in new window

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial