Solved

extract logon/logoff from Windows 2008 event logs

Posted on 2011-03-18
5
1,288 Views
Last Modified: 2012-05-11
Hello,

Windows Server 2008 64-bit.

I'm looking for a way to parse logon/logoff activity for a specific user from the logon server's evtx files. I've checked out several snipets of batch and VBS files but have not been able to get them to work with evtx files.

Thanks,

Geoff
0
Comment
Question by:geoffdavis
  • 2
5 Comments
 
LVL 6

Accepted Solution

by:
Raneesh Chitootharayil earned 250 total points
ID: 35170209
0
 
LVL 8

Assisted Solution

by:Volox
Volox earned 250 total points
ID: 35172523
There is the LogParser that MS makes available...
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en

It not only will parse logs and let you search through them, it will allow you to do it for multiple source machines at the same time - so if you have multiple domain controllers, you can search the logs of all of them to find the entry you are looking for.

Check out the pre-built queries that are included (or at least they used to be included) that will help get you started.
0
 
LVL 8

Expert Comment

by:Volox
ID: 35732985
I think that raneeshcr gave a link to a valid thread and without feedback I have no reason to believe that my answer did not provide a viable solution.  I suggest a split of points between the two of us that responded to this questino.
0

Featured Post

Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Although it can be difficult to imagine, someday your child will have a career of his or her own. He or she will likely start a family, buy a home and start having their own children. So, while being a kid is still extremely important, it’s also …
This article lists the top 5 free OST to PST Converter Tools. These tools save a lot of time for users when they want to convert OST to PST after their exchange server is no longer available or some other critical issue with exchange server or impor…
In this fourth video of the Xpdf series, we discuss and demonstrate the PDFinfo utility, which retrieves the contents of a PDF's Info Dictionary, as well as some other information, including the page count. We show how to isolate the page count in a…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

929 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now