Logon Event ID and Report

[jorgeandresito]

Hi,
I need to make a report about some users and the time they logged on against a Win2003 Server.

I was using the event viewer and while trying to filter some information, i'm not quite sure what Event ID to use regarding the Logon.

Anybody knows what event id is used when a user logs in in a windows server? Any tool that can easily generate reports like these?

Thank you very much!

[themanwhowouldbeking]

The Event ID I believe youre looking for is 528 (successful logon) and 540 (successful network logon).

You could use a visual basic script to list all Event Codes in the Security Log, you just need to change the Event Code as appropriate. Just copy the below into a text file and save as a .vbs file extension.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'Security' and " _
            & "EventCode = '540'")
For Each objEvent in colLoggedEvents
strTimeWritten = objEvent.TimeWritten

    dtmTimeWritten = CDate(Mid(strTimeWritten, 5, 2) & "/" & _
        Mid(strTimeWritten, 7, 2) & "/" & Left(strTimeWritten, 4) _
            & " " & Mid (strTimeWritten, 9, 2) & ":" & _
                Mid(strTimeWritten, 11, 2) & ":" & Mid(strTimeWritten, 13, 2))

    dtmDate = FormatDateTime(dtmTimeWritten, vbShortDate)
    dtmTime = FormatDateTime(dtmTimeWritten, vbLongTime)

Wscript.Echo "Username: " & objEvent.User 
WScript.Echo "Date: " & dtmDate
WScript.Echo "Time: " & dtmTime
Next

To run the file, type the following form a command prompt

cscript filename.vbs

[Lior_S]

very nice, but you can also create a filtered view in the event viewer itself.

[jorgeandresito]

Yep, works great!!! Thanks a lot