?
Solved

How can I easily log all PCs power off and power on time?

Posted on 2011-03-25
12
Medium Priority
?
371 Views
Last Modified: 2012-05-11
Hi Experts,

Is there a way that can easily log/view all PCs in a domain the time it power off and/or power on?

I have tried to setup group policy startup/shutdown script to write a line to a text file on a remote server but it failed, I can do the same to log user's logon and logoff time by a logon/logoff script.

please advice.
0
Comment
Question by:nokyplease
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
  • 2
  • +1
12 Comments
 
LVL 4

Expert Comment

by:m_walker
ID: 35214016
Have a look at your event logs.  There should be a logon event when the computer logs onto the domain (as well as an event when the user logs on).  The issues is of the logoff event does not happen.  loss of power, user just turns off the computer etc.  So log off events can be hit and miss.

If there is not easy solution, then you can get creative, but will requre some work.  That is setup a process on each computer (a windows service would be the best) that sends the computer id to a logging server every X mins.  When you dont get a message for X * 2 mins,assume its off.  When I say some work someone will need to cut some code/script to do it... so wait and see if someone knows of a simple way.

BTW: on out 2003 servers we have a syslog addon that sends all windows events to a linux syslog server that logs them to a flat file. This can help for log searching...
0
 
LVL 23

Expert Comment

by:Danny Child
ID: 35214052
psshutdown from PS Tools is the best remote scriptable shutdown tool
http://technet.microsoft.com/en-us/library/bb842062.aspx

but you need to take care - will you Force a shutdown on a remote machine without saving work?  
0
 
LVL 23

Expert Comment

by:Danny Child
ID: 35214083
If you just want to check how long they're running, the PSList tool (same link as above) gives a good guide to the time since last reboot, if you query the IDLE time.

pslist idle \\<PCname>

it's only a guide, on my present PC, it shows 189 hours, but if I go to Task Manager, add the CPU Time column, and sort by time, I get 189 hours as the top entry, then 3 hours for AV, and everything below that is under an hour - therefore negligible, imho.  

To look at Event Logs, in the System Log, there is event 6005 to Start Event Log Service, and 6006 to Stop Event Log Service.  The latter doesn't get written in an uncontrolled shutdown takes place though.
0
Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 

Author Comment

by:nokyplease
ID: 35214140
I know i can view it from event log, but its a bit difficult to sort and trace it.

What I have done to check user logon/logoff is to setup a simple echo command in the logon/logoff script to save the username, time, computer name to a file with file name e.g. LogOnLogOffStat_<USERNAME>.txt and LogOnLogOffStat_<COMPUTERNAME>.txt

by doing so, i can easily look up a user has been logon to which PC and who has been logged on to a particular PC.

I would like to extend this logging to monitor PC power on and power off. However I tried to use the startup/shudwon script and failed.

My plan is to create something like PC_PowerOnOffStat_<COMPUTERNAME>.txt and hence i can easily check out when a particular PC had been reboot or power down as each PC has it power on off logs.  

Is that when running the startup/shutdown script, the computer cannot write to a network share? the network share i shared out with everyone read and write in both share and NTFS permission.  
0
 
LVL 4

Expert Comment

by:m_walker
ID: 35214158
For testing of your scripts, have the log file saved on the local PC.  That way you can be sure the script is working as expected (without any network related issues).  Then move back to the network knowing the script bit is fine.
 
0
 
LVL 6

Expert Comment

by:JRoyse
ID: 35215264
I think you would be better off using a network monitoring program and ping the hosts.  That would determine when they were on/off and at what times.
0
 
LVL 4

Expert Comment

by:m_walker
ID: 35215308
JRoyse, I agree.  Just need to keep an eye on how much checking is done and the traffic it creates. 20 Computers every 15 mins would be nothing, but 1000 computers server min states to add network load.  

If the network load is to great, then a local app that every x mins updates a local log file.  Then on next startup sends the "last" time checked to the server would provide "this power on" and "est last power off".  
Very little traffic, you will just not know the last power off until its back on again.
0
 
LVL 6

Expert Comment

by:JRoyse
ID: 35216407
I used to monitor desktop workstations with pings ever few minutes with Nagios.  It let me know which computers were active.  

If each ping was 32 bytes, and you pinged each computer 5 times, X1000 computers is roughly 36MB an instance.  not much unless this is a WAN link.
0
 

Author Comment

by:nokyplease
ID: 35216890
the main purpose of the log file is for me to easily trace a particular PC on/off activity in a certain time.

I have nagios setup for monitoring all the servers but it seems too much if adding all PC under nagios monitoring and i also don;t want to get alerts of a PC's ping check is critical or recovered from nagios' email or the web interface. thanks for this idea anyway.

local log is a second choice if a centralized log location cannot be implemented.....
0
 
LVL 4

Accepted Solution

by:
m_walker earned 2000 total points
ID: 35220202
nokyplease, you can do a local log, then upload that on startup/user logon scipt.  
on computer startup
- write the time to a log file. "startup : dd MMM YYYY hh:mm"
- start a background job ("at schedular") that runes ever x mins and writes to a log file : running : dd MMM YYYY hh:mm
On shutdown write t the log file :shutdown : dd MMM YYY hh:mm

This way you will get someething close if the computer is not shut down correctly.

Then say, on user logon, as part of the logn script
- copy local log to server
- clear local log.
0
 

Author Comment

by:nokyplease
ID: 35222152
This may work, but then I need to setup a scheduled task on every pcs.... is there a way to remotely set this up with a batch or script? can I add a scheduled task via winrs or wmic command?
0
 
LVL 4

Assisted Solution

by:m_walker
m_walker earned 2000 total points
ID: 35224167
Chek out the "at" command from a windows dos box

at /? snipit...

AT [\\computername] [ [id] [/DELETE] | /DELETE [/YES]]
AT [\\computername] time [/INTERACTIVE]
    [ /EVERY:date[,...] | /NEXT:date[,...]] "command"

It will need testing and you will need to get the "command" batch file to the remote pc (maybe via a logon script copy.

0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you try to extract and to view the contents of a Microsoft Update Standalone Package (MSU) for Windows Vista, you cannot extract the files from the MSU. Here we are going to explain how to extract those hotfix details without using any third pa…
This article explains how to install and use the NTBackup utility that comes with Windows Server.
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum editing capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question