Solved

Query for User logon times

Posted on 2010-09-02
4
452 Views
Last Modified: 2012-06-27
Hello Experts,

Our legal department has asked for information on each time a user logged on during a specific period of time.  I can get the last time they logged on, but they'd like to see if the user logged in on several specific dates?  Is there even a way to do this?  I have researched but have not been able to find anything.

For reference all servers are Win2k3.  Desktop clients are XP.

Thanks for any insight.

Rick
0
Comment
Question by:DTSC-OEIM
4 Comments
 
LVL 3

Assisted Solution

by:tonyszko
tonyszko earned 75 total points
ID: 33591451
If you have not gathered security logs from domain controllers or workstations from this period there is no way to tell what You are asking for. If You have event logs you can process themto extract logon events.
0
 
LVL 65

Assisted Solution

by:RobSampson
RobSampson earned 75 total points
ID: 33591763
In my environment we pre-emted this scenario, and I have in place a script that will record each user logon and logoff to a text file on the server.  This gave us that history from when I put the script in place.  Otherwise checking your security logs on the DCs is the only other way.

Rob.
0
 
LVL 5

Accepted Solution

by:
rov17 earned 100 total points
ID: 33593267
Hi ,
We using the below VB script to audit users logs on, assign the script as a log in to all users
Hope that helps



On Error Resume Next



strComputer = "."

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")



Set colItems = objWMIService.ExecQuery("Select * from Win32_BIOS",,48)

For Each objItem in colItems

    SerialNumber = trim(objItem.SerialNumber)

Next



Dim Manufacturer 

Dim Model 

Dim MachineName  

Dim SerialNumber 

Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48)

For Each objItem in colItems

	Manufacturer = Trim(objItem.Manufacturer) ' manufacturer

    Model = trim(objItem.Model)		' pc model

    MachineName  = trim(objItem.Name)		' computer netbios name



Next



Dim TotalVisibleMemory 

Dim OperatingSystemAndServicePack 

Set colItems = objWMIService.ExecQuery("Select * from Win32_OperatingSystem",,48)

For Each objItem In colItems

   cOSs = objItem.Name

   pos = InStr(1, cOsS,"|",1)

   cOS1 = left(cOSs,pos-1)

   OperatingSystemAndServicePack =  cOS1 & " " & objItem.CSDVersion

   'TotalVisibleMemory = objItem.TotalVisibleMemorySize

   TotalVisibleMemory = FormatNumber(objItem.TotalVisibleMemorySize/1024,0) + " MEG" 

Next





Dim ProcessorAndClockSpeed 

Set colItems = objWMIService.ExecQuery("Select * from Win32_Processor",,48)

For Each objItem in colItems

ProcessorAndClockSpeed= trim(objItem.Name) & " /" & objItem.CurrentClockSpeed & " MHz"

Next



Dim UserName

set oNet = CreateObject("WScript.Network") 

UserName = oNet.UserName



set wshShell1=Wscript.CreateObject("Wscript.Shell")

set logonserver= WshShell1.ExpandEnvironmentStrings("%logonserver%")









UpdateList UserName,MachineName,Manufacturer,Model,SerialNumber,ProcessorAndClockSpeed,TotalVisibleMemory,OperatingSystemAndServicePack,Width,Height,WshShell1.ExpandEnvironmentStrings("%logonserver%")





Function UpdateList(UserName,MachineName,Manufacturer,Model,SerialNumber,ProcessorAndClockSpeed,TotalVisibleMemory,OperatingSystemAndServicePack,Width,Height,logonserver)

	Dim filename

	filename = "\\share\Logon.csv"

	Const Appending = 8

	Const a = """" ' used at begginging & end

	Const b = """,""" ' used everywhere else.

	Set fso = CreateObject("Scripting.FileSystemObject")

	Set f = fso.OpenTextFile(filename, Appending, False)

	f.WriteLine(a &UserName& b & MachineName & b & Manufacturer& b & Model& b & SerialNumber& b & ProcessorAndClockSpeed& b & TotalVisibleMemory& b & OperatingSystemAndServicePack& b & Width& b & Height& b & logonserver& b &Now()& a)

	f.Close



end Function



Function ScreenResolution()

Set oIE = CreateObject("InternetExplorer.Application")

With oIE

.Navigate("about:blank")

Do Until .readyState = 4: wscript.sleep 100: Loop

width = .document.ParentWindow.screen.width

height = .document.ParentWindow.screen.height

End With

oIE.Quit

ScreenResolution = array(width,height)

End Function

Open in new window

0
 

Author Closing Comment

by:DTSC-OEIM
ID: 33596706
Thanks all, this is more or less what I told them.  Our logs don't go back as far as they want to check, so it's "out of luck" for them.  Thanks Rov17 for the script.  Points for everyone.
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction You may have a need to setup a group of users to allow local administrative access on workstations.  In a domain environment this can easily be achieved with Restricted Groups and Group Policies. This article will demonstrate how to…
Over the years I have built up my own little library of code snippets that I refer to when programming or writing a script.  Many of these have come from the web or adaptations from snippets I find on the Web.  Periodically I add to them when I come…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

929 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now