Establishing who logged on to Windows 10

[talksr]

Hi,

Is there an easy way I can easily establish who logged onto a particular Windows 10 domain connected system on a particular date?

 

There seems to be so much in the event log.

[Oaktech]

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624

[talksr]

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624

 

Thanks, have made a custom view on Event Viewer, but getting no results. Am I missing something?

[chrispounds]

I made a powershell script recently that searches based on parameters you set and pulls back login dates / times etc, you are more than welcome to give it a try

 

import-module ActiveDirectory$comp = ""Get-ADComputer -Filter {OperatingSystem -like "Windows 10*"} -Properties OperatingSystem | Select-Object Name | Format-TableInvoke-Command -ComputerName $comp -File 'N:\PSScripts\Get-LogonHistory.ps1' | Select-Object UserName,Action,TimeStamp | Export-Csv "C:\cpmp.csv"

 

You will have to make sure that you have another file, which has been turned into a function, this is referred to when you see Get-LogonHistory.ps1.

 

It's quite a long one, so i've uploaded both to a pastebin for you.

 

Powershell Script = https://pastebin.com/AeWXxZpT

 

Get-LogonHistory.ps1 = https://pastebin.com/CQhbxCmR

 

Please make sure you run it from an admin account.

 

Any questions, please ask.

Edited June 27, 2017 by chrispounds

[HereIGoAgain2601]

We have a login script that runs - it writes to a network share so we can quickly find out all the machines that a specific user has logged into - useful for tracking misbehaving students, and also who has logged into from any particular machine on the domain. Very useful happy to share

[pfl]

We too use a similar login and logout script for user trackability, this then gets wrote into a mysql database, added some WMI requests as well (eg disk details, OS type and build , freespace as a percentage,current ip address, cpu and ram details, if the logged on user has local admin rights) my dashboard then shows me last 12 logins and last 12 logouts, username and time details and full searching (by hostname or username) has come in useful many times when a student has logged into a staff laptop or has gained local admin rights.