User Login History Details

[wellscs]

Is it possible to search AD to see when and which PC a AD user logged on to?

[6Foot2]

You can look at the properties of the user in Active Directory to see the details of the most recent logon:

 

 

This will not, however, give you the station used.

[sted]

you could add this as a login script (vbs) and it will record the last pc used in a users office field in active directory but its only good for the last logon

 

Const ADS_PROPERTY_CLEAR = 1
Set objSysInfo = CreateObject("ADSystemInfo")
Set objNetwork = CreateObject("WScript.Network")
strCompName = LCase(objNetwork.ComputerName)
strUserDN = objSysInfo.userName
Set objUser = GetObject("LDAP://" & strUserDN) ' Bind to the user object in Active Directory with the LDAP provider.
objUser.Put "physicalDeliveryOfficeName", (strCompName) '...add the computer name to Active Directory profile...
objUser.SetInfo          ' ...and save the changes.

 

if you want historical information (at least going forward if that makes sense) then something like this code will log it to a csv file (again vbs)

 

option explicit  
'On Error Resume Next
dim loggedtime, strComputer, objWMIService, colItems, objItem, logon, logoff, strComputerName, wshShell, WshNetwork 
dim strDirectory, strFile, objFSO, objFile, objfolder, objTextFile
Set wshShell = WScript.CreateObject( "WScript.Shell" )
Set WshNetwork = WScript.CreateObject("WScript.Network")
Set objFSO = CreateObject("Scripting.FileSystemObject")
Const wbemFlagReturnImmediately = &h10
Const wbemFlagForwardOnly = &h20
strComputer = "."
strComputerName = wshShell.ExpandEnvironmentStrings( "%COMPUTERNAME%" )
strDirectory = "[url="file://\\server\logs$\user\"]\\server\logs$\user\[/url]"
strFile = "userlog.csv"
Set objWMIService = GetObject("winmgmts:" & strComputer & "\root\CIMV2")
Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Caption='explorer.exe'", "WQL", _
   wbemFlagReturnImmediately + wbemFlagForwardOnly)
dim creationDate
For Each objItem In colItems
   creationDate = WMIDateStringToDate(objItem.CreationDate)
Next
loggedtime = DateDiff("n", creationDate, Now)
logon = left(creationdate, 10) & "," & right(creationdate, 8)
logoff = left(now, 10) & "," & right(now, 8)
'wscript.echo WshNetwork.UserName & "," & logon & "," & logoff & "," & loggedtime & "," & strComputerName
' Check that the strDirectory folder exists
If objFSO.FolderExists(strDirectory) Then
  Set objFolder = objFSO.GetFolder(strDirectory)
Else
  Set objFolder = objFSO.CreateFolder(strDirectory)
  WScript.Echo "Just created " & strDirectory
End If
If objFSO.FileExists(strDirectory & strFile) Then
  Set objFolder = objFSO.GetFolder(strDirectory)
Else
  Set objFile = objFSO.CreateTextFile(strDirectory & strFile)
  'Wscript.Echo "Just created " & strDirectory & strFile
End If 
set objFile = nothing
set objFolder = nothing
' OpenTextFile Method needs a Const value
' ForAppending = 8 ForReading = 1, ForWriting = 2
Const ForAppending = 8
Set objTextFile = objFSO.OpenTextFile _
(strDirectory & strFile, ForAppending, True)
' Writes result every time you run this VBScript
objTextFile.WriteLine(WshNetwork.UserName & "," & logon & "," & logoff & "," & loggedtime & "," & strComputerName)
objTextFile.Close

Function WMIDateStringToDate(dtmDate)
WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & _
Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) _
& " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))
End Function

 

bear in mind I havnt used wither of these in a while so they need testing and I have no idea if they work beyond windows 7

[3s-gtech]

You can use a logon script to record this info into a single file.

 

rem echo %date% %time% %computername% %username% >>\\server\logs\logon.txt

 

The file will get fairly big, but not unmanageably so.

[Trapper]

The bat file above doesn't seem to work. If you run it when logged on it records the info, but not automatically at logon.

[3s-gtech]

Did you remove the 'rem'? Dozy me, it's REM'd out in our scripts and I left that in the post (if a mod could change that I'd appreciate it!)

 

Otherwise, worked okay for us just like that, but your security procedures may stop it from executing possibly.