Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 681
  • Last Modified:

Command to list out who & date/time of login to a Windows server

I recall seeing somewhere that there's a command that could list out
the login ids of who login to a Windows server (with the timings/date
of login).

Any idea what's that command or how this can be done in the
Windows 2012 GUI?
0
sunhux
Asked:
sunhux
  • 2
  • 2
  • 2
  • +2
6 Solutions
 
Cris HannaCommented:
You have to enable Auditing to track this.

You can edit the Default Domain Policy in the Group Policy Editor

Double-click Computer Configuration, double-click Policies, and then double-click Windows Settings.

Double-click Security Settings, double-click Advanced Audit Policy Configuration, and then double-click System Audit Policies.

Double-click Logon/Logoff, and then double-click Logon.

Select the Configure the following audit events check box, select the Success check box, select the Failure check box, and then click OK.

Then you can review the Security Event Logs
0
 
Steve KnightIT ConsultancyCommented:
In addition to proper security logging and checking the last logon times in AD records, build yourself a record of logoff and logon times if you wish from your login/logoff scripts, e.g. batch method:

@echo off
echo %date%,%time%,%computer%,%username%,LOGON>> "\\server\login-info$\user\%username%.txt"
echo %date%,%time%,%computer%,%username%,LOGON >> "\\server\login-info$\computer\%computername%.txt"

And you end up with a text file for each computer and user.  Add the same to logout script and change to different text file, dir, or change word LOGON to LOGOFF etc...

Can soon do with VBScript or whatever you use instead and record any other details along the way -- e.g. simple audit of hardware in pc, free disc space, list of admin group members if not just default etc...

Steve
0
 
SteveCommented:
The 'quser' command shows what you may be looking for. It's one of several command line ways of using the Remote Desktop Manager functions.
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
Rob WilliamsCommented:
From an earlier post of mine:

You can enable detailed auditing and within the configuration, you can configure the systems and successful and/or failed events you wish to audit. Following articles outline how to enable and analyze the results:
http://support.microsoft.com/kb/814595/
http://www.windowsecurity.com/articles/Understanding_Windows_Logging.html
http://207.46.19.60/technet/prodtechnol/windows2000serv/maintain/monitor/logevnts.mspx

However using auditing can be time consuming to filter and extract.

Another option is to add the lines below to each users logon and log off script to create a log file. It would give you UserName, ComputerName, date and time, in a simple single line, followed by the IP from which they connected, if needed. If you wish to know logoff times as well, you can add the same lines to a log off script in group policy (if you don't already have one: User Configuration | Windows settings | Scripts | Logoff). You likely won’t need the last line (IP address) in the log off script.

As written below it will create the log/text file in \\Server\Logs\LogOns.Log and the entries will look like:
Log File

Log On:  jdoe SERVER1  Tue 1/1/2007   9:01
  TCP    10.0.1.100:3389        66.66.123.123:1234        ESTABLISHED

Log Off: jdoe SERVER1  Tue 1/1/2007   9:31

Log On:  jsmith SERVER2  Tue 1/1/2007   11:00
  TCP    10.0.1.200:3389        66.66.123.124:1234        ESTABLISHED

Log Off: jsmith SERVER1  Tue 1/1/2007   11:30
---------------------------------------------------------------------------

:Logging
If Exist "\\Server\Logs\LogOns.Log" GoTo START
Echo Log File > "\\Server\Logs\LogOns.Log"
:START
Echo. >> "\\Server\Logs\LogOns.Log"
Echo Log On:  %USERNAME% %COMPUTERNAME%  %Date:~0,16%  %Time:~0,5% >> "\\Server\Logs\LogOns.Log"
netstat  -an  |find  "3389"  |find  /I  "established"  >> "\\Server\Logs\LogOns.Log"

---------------------------------------------------------------------------
Note the users will need to have read/write and execute permissions for the \\Server\Logs\LogOns.Log  file.
0
 
Steve KnightIT ConsultancyCommented:
Hmm I assumed this was just asking for users logging in generally rather than to a specific box but can see what you mean, could be either way.

Steve
0
 
sunhuxAuthor Commented:
If I were to restore the file storing the past logins (as it's been overwritten),
which file (& in which folder) do I need to restore so that quser could read
or list out the past logins?
0
 
Rob WilliamsCommented:
Unless you had preconfigured logging there is nothing to restore.  The logs are only created if you configure auditing.  It is off by default as the logs become qquite large.

Unfortunately the reason most of us want to know who logged on is something happened but at that point it is too late to find out, unless we had configured one form of logging ahead of time.
0
 
SteveCommented:
'quser' queries the system directly, just like the remote desktop manager. There is no file involved so no way to look at who was logged in historically.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

  • 2
  • 2
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now