?
Solved

User access Logging

Posted on 2012-04-09
6
Medium Priority
?
496 Views
Last Modified: 2012-08-13
Hello All,

I'm trying to see if it's possible to see how many times a user has logged into a terminal server (specific dates, times, etc.)

Is this something that is possible?
0
Comment
Question by:Timothy McCartney
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
6 Comments
 
LVL 37

Expert Comment

by:Neil Russell
ID: 37823382
Easiest way is with your login script.  Just have it output to a text log file somewhere with the computername, user name, date, time, LOGON or LOGOFF
0
 
LVL 9

Author Comment

by:Timothy McCartney
ID: 37823392
Not positive exactly how one would do that, could you elaborate a little bit more?

Also, if this option had not been in place, is there another way to find this information out? We've had a bit of a security issue and need to try to determine when a user has been logging into a particular sever.
0
 
LVL 17

Expert Comment

by:Anuroopsundd
ID: 37823402
you can check in the event log for the user login and logoff.
Event IDs 528 and 540 signify a successful logon, event ID 538 a logoff
0
Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

 
LVL 17

Expert Comment

by:Anuroopsundd
ID: 37823407
0
 
LVL 37

Accepted Solution

by:
Neil Russell earned 2000 total points
ID: 37823431
The event log will ONLY be any use if you have enabled all the correct Auditing policies AND will only be as useful as the size of your event log allows.....

in a log in script just do something like.....

echo User %USERNAME% logged into computer %COMPUTERNAME% on %DATE% at %TIME% >> \\servername\logins$\logons.log
0
 
LVL 9

Author Closing Comment

by:Timothy McCartney
ID: 37824107
It looks like the required auditing policies were not in place. The security log only shows a handful of entries, none of which are related to logons/offs.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
Learn about cloud computing and its benefits for small business owners.
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…
In this video, Percona Solution Engineer Rick Golba discuss how (and why) you implement high availability in a database environment. To discuss how Percona Consulting can help with your design and architecture needs for your database and infrastr…
Suggested Courses

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question