Tech or Treat! Write an article about your scariest tech disaster to win gadgets!Learn more

x
?
Solved

extract logon/logoff from Windows 2008 event logs

Posted on 2011-03-18
5
Medium Priority
?
1,297 Views
Last Modified: 2012-05-11
Hello,

Windows Server 2008 64-bit.

I'm looking for a way to parse logon/logoff activity for a specific user from the logon server's evtx files. I've checked out several snipets of batch and VBS files but have not been able to get them to work with evtx files.

Thanks,

Geoff
0
Comment
Question by:geoffdavis
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
5 Comments
 
LVL 6

Accepted Solution

by:
Raneesh Chitootharayil earned 1000 total points
ID: 35170209
0
 
LVL 8

Assisted Solution

by:Volox
Volox earned 1000 total points
ID: 35172523
There is the LogParser that MS makes available...
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en

It not only will parse logs and let you search through them, it will allow you to do it for multiple source machines at the same time - so if you have multiple domain controllers, you can search the logs of all of them to find the entry you are looking for.

Check out the pre-built queries that are included (or at least they used to be included) that will help get you started.
0
 
LVL 8

Expert Comment

by:Volox
ID: 35732985
I think that raneeshcr gave a link to a valid thread and without feedback I have no reason to believe that my answer did not provide a viable solution.  I suggest a split of points between the two of us that responded to this questino.
0

Featured Post

Nothing ever in the clear!

This technical paper will help you implement VMware’s VM encryption as well as implement Veeam encryption which together will achieve the nothing ever in the clear goal. If a bad guy steals VMs, backups or traffic they get nothing.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Resolving an irritating Remote Desktop connection that stops your saved credentials from being used.
This article describes how to import Lotus Notes Contacts into Outlook 2016, 2013, 2010 and 2007 etc. with a few manual steps. You can easily export and migrate Lotus Notes contacts into Microsoft Outlook without having to use any third party tools.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

648 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question