Command to list out who & date/time of login to a Windows server

I recall seeing somewhere that there's a command that could list out
the login ids of who login to a Windows server (with the timings/date
of login).

Any idea what's that command or how this can be done in the
Windows 2012 GUI?
Who is Participating?

Improve company productivity with a Business Account.Sign Up

Cris HannaConnect With a Mentor Commented:
You have to enable Auditing to track this.

You can edit the Default Domain Policy in the Group Policy Editor

Double-click Computer Configuration, double-click Policies, and then double-click Windows Settings.

Double-click Security Settings, double-click Advanced Audit Policy Configuration, and then double-click System Audit Policies.

Double-click Logon/Logoff, and then double-click Logon.

Select the Configure the following audit events check box, select the Success check box, select the Failure check box, and then click OK.

Then you can review the Security Event Logs
Steve KnightConnect With a Mentor IT ConsultancyCommented:
In addition to proper security logging and checking the last logon times in AD records, build yourself a record of logoff and logon times if you wish from your login/logoff scripts, e.g. batch method:

@echo off
echo %date%,%time%,%computer%,%username%,LOGON>> "\\server\login-info$\user\%username%.txt"
echo %date%,%time%,%computer%,%username%,LOGON >> "\\server\login-info$\computer\%computername%.txt"

And you end up with a text file for each computer and user.  Add the same to logout script and change to different text file, dir, or change word LOGON to LOGOFF etc...

Can soon do with VBScript or whatever you use instead and record any other details along the way -- e.g. simple audit of hardware in pc, free disc space, list of admin group members if not just default etc...

SteveConnect With a Mentor Commented:
The 'quser' command shows what you may be looking for. It's one of several command line ways of using the Remote Desktop Manager functions.
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Rob WilliamsConnect With a Mentor Commented:
From an earlier post of mine:

You can enable detailed auditing and within the configuration, you can configure the systems and successful and/or failed events you wish to audit. Following articles outline how to enable and analyze the results:

However using auditing can be time consuming to filter and extract.

Another option is to add the lines below to each users logon and log off script to create a log file. It would give you UserName, ComputerName, date and time, in a simple single line, followed by the IP from which they connected, if needed. If you wish to know logoff times as well, you can add the same lines to a log off script in group policy (if you don't already have one: User Configuration | Windows settings | Scripts | Logoff). You likely won’t need the last line (IP address) in the log off script.

As written below it will create the log/text file in \\Server\Logs\LogOns.Log and the entries will look like:
Log File

Log On:  jdoe SERVER1  Tue 1/1/2007   9:01

Log Off: jdoe SERVER1  Tue 1/1/2007   9:31

Log On:  jsmith SERVER2  Tue 1/1/2007   11:00

Log Off: jsmith SERVER1  Tue 1/1/2007   11:30

If Exist "\\Server\Logs\LogOns.Log" GoTo START
Echo Log File > "\\Server\Logs\LogOns.Log"
Echo. >> "\\Server\Logs\LogOns.Log"
Echo Log On:  %USERNAME% %COMPUTERNAME%  %Date:~0,16%  %Time:~0,5% >> "\\Server\Logs\LogOns.Log"
netstat  -an  |find  "3389"  |find  /I  "established"  >> "\\Server\Logs\LogOns.Log"

Note the users will need to have read/write and execute permissions for the \\Server\Logs\LogOns.Log  file.
Steve KnightIT ConsultancyCommented:
Hmm I assumed this was just asking for users logging in generally rather than to a specific box but can see what you mean, could be either way.

sunhuxAuthor Commented:
If I were to restore the file storing the past logins (as it's been overwritten),
which file (& in which folder) do I need to restore so that quser could read
or list out the past logins?
Rob WilliamsConnect With a Mentor Commented:
Unless you had preconfigured logging there is nothing to restore.  The logs are only created if you configure auditing.  It is off by default as the logs become qquite large.

Unfortunately the reason most of us want to know who logged on is something happened but at that point it is too late to find out, unless we had configured one form of logging ahead of time.
SteveConnect With a Mentor Commented:
'quser' queries the system directly, just like the remote desktop manager. There is no file involved so no way to look at who was logged in historically.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.