Login and Logoff report

[asam71]

I've been asked by my director to come up with a way to run a report for login and logoff times for our users.

Does anyone know of any tools for this? I'm sure the info would need to come from the security logs on the domain controllers. I have 3 domain controllers for our domain and I don't want to look at each individually to find this info.

Does anyone have any ideas?

[stoo.mp]

I wrote a little script to do the same thing... also gives IP address, Machine Name, User Name, Date, Time..

It uses KIX... are you familiar with it? (it's a VERY simple script program)

Will post the script in a sec...

KIX: http://www.kixtart.org/

[stoo.mp]

KIX script for logging a users login:

Firstly, get Kixtart from the URL above.

Save the required files to the NETLOGON folder on your DC (see the quick-start guide for KIX).

Create a .BAT file which will call the LOGIN portition.

In the .BAT file put:

@echo off
\\SERVER_NAME\netlogon\kix32 \\SERVER_NAME\netlogon\log_login.kix

Save the file as LOG_LOGIN.BAT (or something)

Create a new txt file, rename it LOG_LOGIN.KIX and open in notepad. Enter this:

IF Open( 3 , "\\**PATH_TO_SAVE_TO**\LOG.TXT" , 5 ) = 0
  $x = WriteLine( 3 , "Logged In:," + @MDayNo + "/" + @Month + "/" + @Year + "  " + @TIME + "," + @UserID + "," + @WkSta + "," + @IPADDRESS0 + @CRLF )
ELSE
  BEEP
  ? "failed to open file, error code : [" + @ERROR + "]"
ENDIF

Save this as the same name in LOG_LOGIN.BAT (eg: LOG_LOGIN.KIX)

Next create a .BAT file for the log out and enter:

@echo off
\\SERVER_NAME\netlogon\kix32 \\SERVER_NAME\netlogon\log_logout.kix

Create another txt file for logging a users logout rename it LOG_LOGOUT.KIX :

IF Open( 3 , "\\**PATH_TO_SAVE_TO**\LOG.TXT" , 5 ) = 0
  $x = WriteLine( 3 , "Logged Out:," + @MDayNo + "/" + @Month + "/" + @Year + "  " + @TIME + "," + @UserID + "," + @WkSta + "," + @IPADDRESS0 + @CRLF )
ELSE
  BEEP
  ? "failed to open file, error code : [" + @ERROR + "]"
ENDIF

(Both scripts write the same LOG.TXT and is comma-delimited for easy import in to Excel and filtering a users activity)

Now, add the call to each .BAT file in AD via GPO's.... shout if you need help with adding login/logout GPO configurations.

Stoo

(adapt any paths/filenames to suit your network and needs)

[stoo.mp]

Here's an example output (ignore the names :P )

Logged In:,23/June/2005  09:29:28,WHSGB,CDSERVER02,169.254.254.250
Logged In:,23/June/2005  09:45:29,bickersn,CDSERVER02,169.254.254.250
Logged In:,23/June/2005  09:50:38,jenningsa,CDSERVER02,169.254.254.250
Logged Out:,23/June/2005  17:26:36,townsendb,ELITE12,169.254.254. 54
Logged Out:,23/June/2005  17:27:16,evenettg,GELAPTOP,169.254.254. 25
Logged Out:,23/June/2005  17:29:03,jonesc,INDUSTRIAL4,169.254.254. 33

[windux]

If you want some comercial software you can see here one example:

http://www.isdecisions.com/index.cfm...s-WinReporter#

Another way to do this, audit you login/logon in windows and then extract from event log to one file or data base with scripting.