Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Reporting on user's log in/out times in Active Directory without using the event log

Posted on 2012-12-27
9
Medium Priority
?
696 Views
Last Modified: 2014-08-02
Hello everyone, a department manager I work with is asking for a way to report on selected users for when they log in/out of the network (Active Directory) and the only way I know of is in the event logs and depending on what domain controller they authenticate on it's then logged into that event log on that server.  Does anyone know if Microsoft has a more efficent way to see this data or maybe a 3rd party product for this?

Thank you everyone.
0
Comment
Question by:jbishop2446b
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
9 Comments
 
LVL 22

Accepted Solution

by:
mcsween earned 2000 total points
ID: 38724547
Do you have a SQL server there?  You could create a database on the server with a table called emp_logins with the columns
userid
login_off_datetime
login_or_logoff

Then run this script as part of the user's logon script
Set wshNetwork = CreateObject("WScript.Network")
Dim OdbcDSN, connect, sql, resultSet, strUsername

strUsername = wshNetwork.UserName
OdbcDSN = "Driver=SQL Server;Server=YOURSQLSERVER;UID=someuser;PWD=somepassword;Database=somedatabase"
Set connect = CreateObject("ADODB.Connection")
connect.Open OdbcDSN

sql="insert into emp_logins (userid,login_off_datetime,login_or_logoff) values ('" & strUsername & "',getdate(),'I')"

Set resultSet = connect.Execute(sql)

Open in new window


And this script as a user logoff script
Set wshNetwork = CreateObject("WScript.Network")
Dim OdbcDSN, connect, sql, resultSet, strUsername

strUsername = wshNetwork.UserName
OdbcDSN = "Driver=SQL Server;Server=YOURSQLSERVER;UID=someuser;PWD=somepassword;Database=somedatabase"
Set connect = CreateObject("ADODB.Connection")
connect.Open OdbcDSN

sql="insert into emp_logins (userid,login_off_datetime,login_or_logoff) values ('" & strUsername & "',getdate(),'O')"

Set resultSet = connect.Execute(sql)

Open in new window


To run a report just execute the query in SQL Query Analyzer
SELECT * FROM emp_logins WHERE userid = 'SomeUserName'

Open in new window


Make sure you update the values in the script for
YOURSQLSERVER
someuser
somepassword
somedatabase
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 38724567
You could create a simple logon/logoff script, example below

http://msmvps.com/blogs/kwsupport/archive/2005/02/24/36942.aspx

event logs like you said can track it but consolidating and searching them can be a pain depending on how many DCs you have.

Thanks

Mike
0
 
LVL 22

Expert Comment

by:mcsween
ID: 38724569
I forgot to mention in case it's not obvious; my code is in vbscript (.vbs).
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 

Author Comment

by:jbishop2446b
ID: 38724590
Thank you so much! I'm going to try this out now, I've never used a logoff script but will figure that out in AD.  I'll come back soon and accept the solution!  ;)
0
 

Author Comment

by:jbishop2446b
ID: 38724602
Thank you "mcsween"!  I have a .vbs script I use for mapping sharepoint to a network drive and will test your solution out.  J
0
 
LVL 22

Expert Comment

by:mcsween
ID: 38724604
You can do logon and logoff scripts from Group Policy.

User Configuration, Windows Settings, Scripts (Logon/Logoff)
0
 
LVL 4

Expert Comment

by:palicos
ID: 38726335
You have two ways to do this without event log.

First, you can use this link to audit the login/logout activity of the users.

http://help.isdecisions.com/winreporter/english/Reference/EventLogReports/LogonLogoff_Activity.htm

Moreover, in case you dont want to use the logs then you can use third party tool for AD auditing but these tools are not free.
0
 

Author Closing Comment

by:jbishop2446b
ID: 39041969
FANTASTIC, thank you so much and sorry for getting back to you so late.  I just recently implemented.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the absence of a fully-fledged GPO Management product like AGPM, the script in this article will provide you with a simple way to watch the domain (or a select OU) for GPOs changes and automatically take backups when policies are added, removed o…
A bad practice commonly found during an account life cycle is to set its password to an initial, insecure password. The Password Reset Tool was developed to make the password reset process easier and more secure.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
Suggested Courses

671 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question