Log logons

[FN-GM]

Hi

 

I plan to add a few lines to out logon script to check who has logged onto a machine in the event of damage & to trace where a user has been logging on.

 

So I will need to lots, a log file that will display where a user has logged on & who has logged onto a particular machine. I would like to log the time and date as well.

 

I have no idea how to do this though. Please can someone post there’s if they have done the same or point me into the right direction please?

Cheers

 

Z

[OutToLunch]

You should have this in the event log on the server assuming you mean networked PCs? Can't remember the event ID's but there's one for log on, one for log off. The only problem with any kind of script like this is the log off part never really takes into account crashes/random reboots/power outage... There's also been a script posted here before to log to MySQL or plain text if you use the search.

[JJonas]

add to logon script something like this...

 

 

echo %date% %time% %computername% %username% >>\\MyServerName\logon$\logons.txt

 

 

works for me.

[tomscaper]

Would the script cause any problems regarding many students logging on at once, and all trying to write to the same file at the same time. As i was interested in using this as well.

[pallen]

The logon script I use was posted on here. It creates a log txt file for each computer & users so you can trace computer history and users history if you need.

 

I'm sure you'll find it if you do a search on here

 

Take a look at this Limit Logon VBS Version - EduGeek.net Forums

Edited April 28, 2008 by pallen

[browolf]

add to logon script something like this...

 

 

echo %date% %time% %computername% %username% >>\\MyServerName\logon$\logons.txt

 

 

works for me.

 

i do it like

 

for /f "tokens=1,2,3* delims=/ " %%a in ('date /t') do set date=%%a%%b%%c%%d
for /f "tokens=1,2 delims=:" %%a in ('time /t') do set time=%%a%%b
echo %date%,%time%,%username% >> \\backup\logs$\computer\%computername%.txt
echo %date%,%time%,%computername% >> \\backup\logs$\user\%username%.txt

 

cos sometimes its helpful to cross-reference

 

I also do

 

ipconfig | find "IP Address" > \\backup\logs$\ips\%computername%.txt

 

and

 

rem log mac addresses
del \\backup\logs$\lapmacs\%computername%.log /q >nul
for /f "tokens=2 delims=:" %%a in ('ipconfig /all ^| find "physical" /i ') do (
for /f %%b in ('cscript //nologo \\server1\netlogon\strip.vbs %%a') do (
	rem set MACSTR=%%b 
	echo %computername% > \\backup\logs$\lapmacs\%%b.log
	echo %%b >> \\backup\logs$\lapmacs\%computername%.log
)
)

[FN-GM]

You should have this in the event log on the server assuming you mean networked PCs? Can't remember the event ID's but there's one for log on, one for log off. The only problem with any kind of script like this is the log off part never really takes into account crashes/random reboots/power outage... There's also been a script posted here before to log to MySQL or plain text if you use the search.

 

Yes i know but we are after something that is easier to view etc.

 

add to logon script something like this...

 

 

echo %date% %time% %computername% %username% >>\\MyServerName\logon$\logons.txt

 

 

works for me.

 

Thanks i will look into it

 

i do it like

 

for /f "tokens=1,2,3* delims=/ " %%a in ('date /t') do set date=%%a%%b%%c%%d
for /f "tokens=1,2 delims=:" %%a in ('time /t') do set time=%%a%%b
echo %date%,%time%,%username% >> \\backup\logs$\computer\%computername%.txt
echo %date%,%time%,%computername% >> \\backup\logs$\user\%username%.txt

 

cos sometimes its helpful to cross-reference

 

I also do

 

ipconfig | find "IP Address" > \\backup\logs$\ips\%computername%.txt

 

and

 

rem log mac addresses
del \\backup\logs$\lapmacs\%computername%.log /q >nul
for /f "tokens=2 delims=:" %%a in ('ipconfig /all ^| find "physical" /i ') do (
for /f %%b in ('cscript //nologo \\server1\netlogon\strip.vbs %%a') do (
	rem set MACSTR=%%b 
	echo %computername% > \\backup\logs$\lapmacs\%%b.log
	echo %%b >> \\backup\logs$\lapmacs\%computername%.log
)
)

 

 

I will also look into this one

 

 

Thanks alot guys

[dan400007]

We use an Access DB to log all Logon and Logoff Events:

 

strAS = "\\DC-01\File_Store\Auditdb"

 

if not objFSO.FileExists(strAS & "\Logon.mdb") Then

objFSO.CopyFile "" & strAS & "\default\logon.mdb", "" & strAS & "\logon.mdb", True

end if

 

Set objConn = CreateObject("ADODB.Connection")

objConn.Open "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & strAS & "\Logon.mdb"

objConn.Execute "INSERT INTO Logon (Operation, UserName, OU, ComputerName, Date1, Time1) VALUES ('Logon', """ & strUserName & """, '" & strOU & "', '" & strComputerName & "', " & strDate & ", #" & Time & "#)"

objConn.Close

 

If err.number then msgbox "Unable to write to the logon/logoff audit database. Please contact the Technicians."

 

Set objConn = Nothing

 

Function strFormatDate(strDate)

'Returns the formatted Date

 

Dim intday, year, datelength, day

Dim dayLength, iYear, iMonth, iDay

 

datelength = len(strDate)

 

intday = InStr(1, strDate, "/")

year = InStrRev (strDate, "/")

 

dayLength = year - intday - 1

day = mid( strDate, intday + 1, dayLength )

 

iYear = Right( strDate, dateLength-year )

iMonth = Left( strDate, intday - 1 )

 

iDay = day

 

strDate = "#" & iDay & "/" & iMonth & "/" & iYear & "#"

strFormatDate = strDate

 

End Function

[FN-GM]

Ok so if i have read this script right, this is the location of the database:

 

\\DC-01\File_Store\Auditdb\logon.mdb

 

And if the database does not exist it will copy it from another location?

 

Thanks for that script just what i am after.

Edited April 28, 2008 by FN-Greatermanchester

[dan400007]

Not quite. Basicly you have a backup copy just in case you need to move the current log elsewhere for checking.

 

\\DC-01\File_Store\Auditdb\logon.mdb is just the UNC path to where you want the database to be stored. You'll need to give authenticated users Modify access to it so I suggest you hide it away somewhere (hidden share or such like).

 

I've attached the basic DB, it only a table but makes life easy when you need to search all the computers on the network to see where a kid has logged on.

Logon.zip

[dan400007]

And if the database does not exist it will copy it from another location?

 

I really need to learn to read...

[FN-GM]

Just the job, cheers

[FN-GM]

sorry show do you log a logoff please?

 

Thanks

[Guest Guest]

^ Put the same script in "logoff scripts" instead of "logon sscripts" in GP

[dan400007]

Have 2 scripts, one for logon and another for logoff. They'll both be the same apart from the value of the Operation field in the SQL statement. There is probably a way for the script to detect if its a logon or logoff but thats beyond me.

[FN-GM]

Thanks its jsut what i need. One last question, do you use the same database for logon and log off? plus do you need to clear the database often?

[dan400007]

Yeah we use the same db for logon and logoff.

 

We generally let it run until it becomes a problem, ie people recieving the 'unable to write to database' error in the script. Currently the DB we're using has been going since the start of the year and has 80,000 entries.

[FN-GM]

Ah right perfect solution. I will just archive the Database every term then.

 

Cheers

 

PS: Can I post this on the Wiki please?

[dan400007]

Sure, I'll post a couple more scripts to the Wiki later this week.