Solved

Query for User logon times

Posted on 2010-09-02
4
456 Views
Last Modified: 2012-06-27
Hello Experts,

Our legal department has asked for information on each time a user logged on during a specific period of time.  I can get the last time they logged on, but they'd like to see if the user logged in on several specific dates?  Is there even a way to do this?  I have researched but have not been able to find anything.

For reference all servers are Win2k3.  Desktop clients are XP.

Thanks for any insight.

Rick
0
Comment
Question by:DTSC-OEIM
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 3

Assisted Solution

by:tonyszko
tonyszko earned 75 total points
ID: 33591451
If you have not gathered security logs from domain controllers or workstations from this period there is no way to tell what You are asking for. If You have event logs you can process themto extract logon events.
0
 
LVL 65

Assisted Solution

by:RobSampson
RobSampson earned 75 total points
ID: 33591763
In my environment we pre-emted this scenario, and I have in place a script that will record each user logon and logoff to a text file on the server.  This gave us that history from when I put the script in place.  Otherwise checking your security logs on the DCs is the only other way.

Rob.
0
 
LVL 5

Accepted Solution

by:
rov17 earned 100 total points
ID: 33593267
Hi ,
We using the below VB script to audit users logs on, assign the script as a log in to all users
Hope that helps


On Error Resume Next

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colItems = objWMIService.ExecQuery("Select * from Win32_BIOS",,48)
For Each objItem in colItems
    SerialNumber = trim(objItem.SerialNumber)
Next

Dim Manufacturer 
Dim Model 
Dim MachineName  
Dim SerialNumber 
Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48)
For Each objItem in colItems
	Manufacturer = Trim(objItem.Manufacturer) ' manufacturer
    Model = trim(objItem.Model)		' pc model
    MachineName  = trim(objItem.Name)		' computer netbios name

Next

Dim TotalVisibleMemory 
Dim OperatingSystemAndServicePack 
Set colItems = objWMIService.ExecQuery("Select * from Win32_OperatingSystem",,48)
For Each objItem In colItems
   cOSs = objItem.Name
   pos = InStr(1, cOsS,"|",1)
   cOS1 = left(cOSs,pos-1)
   OperatingSystemAndServicePack =  cOS1 & " " & objItem.CSDVersion
   'TotalVisibleMemory = objItem.TotalVisibleMemorySize
   TotalVisibleMemory = FormatNumber(objItem.TotalVisibleMemorySize/1024,0) + " MEG" 
Next


Dim ProcessorAndClockSpeed 
Set colItems = objWMIService.ExecQuery("Select * from Win32_Processor",,48)
For Each objItem in colItems
ProcessorAndClockSpeed= trim(objItem.Name) & " /" & objItem.CurrentClockSpeed & " MHz"
Next

Dim UserName
set oNet = CreateObject("WScript.Network") 
UserName = oNet.UserName

set wshShell1=Wscript.CreateObject("Wscript.Shell")
set logonserver= WshShell1.ExpandEnvironmentStrings("%logonserver%")




UpdateList UserName,MachineName,Manufacturer,Model,SerialNumber,ProcessorAndClockSpeed,TotalVisibleMemory,OperatingSystemAndServicePack,Width,Height,WshShell1.ExpandEnvironmentStrings("%logonserver%")


Function UpdateList(UserName,MachineName,Manufacturer,Model,SerialNumber,ProcessorAndClockSpeed,TotalVisibleMemory,OperatingSystemAndServicePack,Width,Height,logonserver)
	Dim filename
	filename = "\\share\Logon.csv"
	Const Appending = 8
	Const a = """" ' used at begginging & end
	Const b = """,""" ' used everywhere else.
	Set fso = CreateObject("Scripting.FileSystemObject")
	Set f = fso.OpenTextFile(filename, Appending, False)
	f.WriteLine(a &UserName& b & MachineName & b & Manufacturer& b & Model& b & SerialNumber& b & ProcessorAndClockSpeed& b & TotalVisibleMemory& b & OperatingSystemAndServicePack& b & Width& b & Height& b & logonserver& b &Now()& a)
	f.Close

end Function

Function ScreenResolution()
Set oIE = CreateObject("InternetExplorer.Application")
With oIE
.Navigate("about:blank")
Do Until .readyState = 4: wscript.sleep 100: Loop
width = .document.ParentWindow.screen.width
height = .document.ParentWindow.screen.height
End With
oIE.Quit
ScreenResolution = array(width,height)
End Function

Open in new window

0
 

Author Closing Comment

by:DTSC-OEIM
ID: 33596706
Thanks all, this is more or less what I told them.  Our logs don't go back as far as they want to check, so it's "out of luck" for them.  Thanks Rov17 for the script.  Points for everyone.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article outlines the process to identify and resolve account lockout in an Active Directory environment.
This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question