User Loggedin/Loggedoff Information!

Posted on 2012-09-11
Last Modified: 2012-09-25
Dear EE,

Is there any way, we can track the information about logged in windows user was logged off for some specific date time ? in windows server 2003 Sp2 (Without using any tool)

Question by:Netsol-NOS
    LVL 39

    Expert Comment

    by:Krzysztof Pytko
    For detailed information, you need to review all Security Event Logs on each Domain Controller or if it enough, you may check when user was logged on in a domain for the last time. If you're interested, you may visit my blog and read an article about that at


    Author Comment

    Thank you for prompt action,

    Well i am not on domain controller. i just want to see on local server.
    LVL 39

    Accepted Solution

    OK, so there is only one possibility. Review Security Event Log on that server to gather required information. Quite a lot to read :/

    LVL 19

    Expert Comment

    by:Manoj Patil
    For Active directory user’s logon and logoff reports, it needs the third party tools. But in windows have that capability. Most of the IT professionals are not learned DOS commands in-depth. The DOS command does this process. All are heard about echo command; this command can do the report for our need.

    For Example:-
    Go to your command prompt, type the below following command.
    Echo %username% is logged on to %computername% at %time%

    The above command gives the output like his name, computer name and login time. Our need is to generate report for all users, so here we need to create a logon batch file script. Before creating the batch file, we need to create a central repository for storing the log files. Create a hidden share for logon, logoff and give the permission to users.Batch file for logon script Copy the below code edit the systemname, sharename and paste into the notepad, then save it as batch (.bat) file.
    Echo %username% is logged on to %computername% at %time% >> \\systemname\Sharename$\%username%_logon.csv
    The batch file needs to put on the logon script in the group policy. All log files will be save in separate for each users. Please find the below image, that was the output.

    Active Directory Report

    For Log off report use the below command for batch file
    Echo %username% is logged on to %computername% at %time% >> \\systemname\Sharename$\%username%_logoff.csv
    Copy the above code and create a batch file, apply on the logoff script in the group policy.

    Author Closing Comment

    True i found the user logoff and login information in security event viewer log the event id is  528 and 538.

    Featured Post

    Top 6 Sources for Identifying Threat Actor TTPs

    Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

    Join & Write a Comment

    Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
    Learn about cloud computing and its benefits for small business owners.
    Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
    With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now