Solved

Windows Server Log Off Alert

Posted on 2015-01-28
5
301 Views
Last Modified: 2015-01-29
I would like to get an email alert when someone logs off a Windows Server 2008.  

Is there an application or script that can handle this?

Thanks for your help.

David
0
Comment
Question by:David Lo
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
5 Comments
 
LVL 4

Accepted Solution

by:
Praveen Kumar Bonala earned 500 total points
ID: 40576459
No third party tools, scripts required to configure.
Following link for step by step procedure to configure email alert on windows logoff.

http://www.intelliadmin.com/index.php/2011/01/get-an-email-notification-on-system-logon/

Note: in above link EVENT ID: 4624 used. EVENT ID 4624 indicates successful log on. Kindly use EVENT ID: 4647 instead of 4624.
0
 
LVL 11

Expert Comment

by:Maclean
ID: 40576460
Intrigued as to why you would want this, just out of interest.

I can supply part of a solution which is to create a server share for log off logs with read/write access to users utilizing this (Perhaps a group might be useful) , to use with the below batch example

e.g.

Filename = "Server Log Off.bat" (Or anything you see fit)
Add the text listed between the lines into the file, and correct the share name.

======================================================

rem The following line creates a circular log file of usage by server
echo Log Off %Date% %TIME% %USERNAME% >> \\servername\Logsshare\Computer\%COMPUTERNAME%.log

rem The following line creates a circular log file of usage by user
echo Log Off %Date% %TIME% %COMPUTERNAME% >> \\servername\Logsshare\User\%USERNAME%.log

=============================================================

When done, create a GPO applied to server users only under the log off scripts

User Configuration > Windows Settings > Scripts > Logoff

Now the question would remain as to how you can get the logged data emailed to you.
I might be over complicating it, but I would probably look at creating a scheduled email alert everytime that the log off event occurs on the event logs.

I found an article here which might help there, but if any others have a better solution, I'd look at what works best for you. The scheduled task on each server can be done via GPO to lower amount of time spent configuring it though.

http://blogs.iis.net/rickbarber/archive/2012/10/26/send-an-email-when-an-event-is-logged.aspx

EDIT: Or use the previous comments solution, seems to work more simple than mine.
0
 
LVL 81

Expert Comment

by:David Johnson, CD, MVP
ID: 40576527
rem The following line creates a circular log file of usage by server not circular since a circular log when the log reaches a certain size or other condition new events overwrite the oldest events. These logs are never ending..
0
 
LVL 2

Author Comment

by:David Lo
ID: 40576554
Thank you for your ideas.

If I am correct, these solutions are for all logoff events for the domain.  Is there any way to limit the monitoring to just the log offs on the server itself?
0
 
LVL 9

Expert Comment

by:schmiegu
ID: 40576890
The IntelliAdmin solution only works on the Server you create the scheduled task on. You may want to deploy the Task via Group policy, but there's no Need to
0

Featured Post

Guide to Performance: Optimization & Monitoring

Nowadays, monitoring is a mixture of tools, systems, and codes—making it a very complex process. And with this complexity, comes variables for failure. Get DZone’s new Guide to Performance to learn how to proactively find these variables and solve them before a disruption occurs.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
SolarWind and DNS Server 12 105
Problems with Microsoft.DHCP.PowerShell.Admin Module 4 102
How to rollback Windows updates with SCCM? 6 121
Problem to Citrix 2 70
Some time ago I faced the need to use a uniform folder structure that spanned across numerous sites of an enterprise to be used as a common repository for the Software packages of the Configuration Manager 2007 infrastructure. Because the procedu…
When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

737 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question