Report on logon/logoff times

[enjay]

One of our teachers is asking if we can generate a report of when they logged on and off in a given timeframe. I've tried Event Viewer on the client and server, but there's too much noise and false positives (phone connecting in to check mail, perhaps?). Any ideas?

[sted]

depends how simple you want it you could literally write a batch file that when someone logs on/off records the time to a csv file either on a per pc or per user basis

[BKGarry]

I have a batch file for logon and one for logoff which has the following within it

 

 

Logon

echo logon %username% %computername% %date% %time% >> \\\LogonStats$\Computer\%computername%.log
echo logon, %username%, %computername%, %date%, %time% >> \\\LogonStats$\userlog.csv
echo logon %username% %computername% %date% %time% >> \\\LogonStats$\Username\%username%.log

 

Logoff

echo logoff %username% %computername% %date% %time% >> \\\LogonStats$\Computer\%computername%.log
echo logoff, %username%, %computername%, %date%, %time% >> \\\LogonStats$\userlog.csv
echo logoff %username% %computername% %date% %time% >> \\\LogonStats$\Username\%username%.log

 

Does exactly what we need, although we have impero, we seem to be able to use this a lot quicker.

[enjay]

Sorry, I should have been more specific - they want a list of times they've previously logged in, not a list moving forward from today.

[BKGarry]

Ah, this powershell script may point you in the right direction there https://social.technet.microsoft.com/wiki/contents/articles/51413.active-directory-how-to-get-user-login-history-using-powershell.aspx

[k-strider]

we use login and out VBS scripts that shove the information into a SQL Express database... the database timestamps it as the row is writen so the time is correct (incase the workstation is out)

i wrote a c# program to interogate it

 

this is the basic content of the sign in script.

 

on error resume next

 

dim m_cn, m_rs, s_sql

 

Set m_cn = CreateObject("adodb.connection")

m_cn.open "Driver={SQL Server};Server=SERVERNAME\IT;Database=dbSign;Trusted_Connection=True;"

 

Set m_rs = CreateObject("adodb.recordset")

Set WshNetwork = CreateObject("WScript.Network")

 

s = Wshnetwork.computername

nm = wshnetwork.username

 

 

s_sql = "INSERT INTO Tbl_Sign (SignUser, SignComputer, SignLogInOut) VALUES ('" & nm & "','" & s & "','1')"

 

m_rs.open s_SQL, m_cn, adOpenStatic

 

obviously that doesnt help with previous ones... but its probably worth setting something up we use this all the time....

Edited June 28, 2019 by k-strider

[sted]

we use login and out VBS scripts that shove the information into a SQL Express database... the database timestamps it as the row is writen so the time is correct (incase the workstation is out)

i wrote a c# program to interogate it [ATTACH=CONFIG]54040[/ATTACH]

 

this is the basic content of the sign in script.

 

 

 

obviously that doesnt help with previous ones... but its probably worth setting something up we use this all the time....

 

ive never really used sql but i can see that being useful for other things do you have some sort of dummies guide for setting up the sql part of this?

[k-strider]

i set it up ages ago via SQL Managment Studio to the point i have moved it from one old SQL server to another .... i really cant remember how i got the date to auto install or the SignID (the key) to auto incrament... but looking at the DB in SQL the constraints must have something to do with inserting the date and the Trigger basically cleans up anything over a year old so the DB doesnt grow indefinatley

Trigger:

USE [dbSign]

GO

/****** Object: Trigger [dbo].[cleanupTableTwoWeeks] Script Date: 01/07/2019 11:30:49 ******/

SET ANSI_NULLS ON

GO

SET QUOTED_IDENTIFIER ON

GO

 

ALTER TRIGGER [dbo].[cleanupTableTwoWeeks] ON [dbo].[Tbl_Sign]

FOR INSERT, UPDATE

AS

DECLARE @theDateMinus2 datetime

SELECT @theDateMinus2 = ((SELECT getdate()) - 365)

BEGIN

PRINT @theDateMinus2

DELETE FROM Tbl_Sign

WHERE servertime <= (@theDateMinus2)

END

 

Edit: i do have the source code for the front end that i use still

Edited July 1, 2019 by k-strider

[Sephiroth]

we use login and out VBS scripts that shove the information into a SQL Express database... the database timestamps it as the row is writen so the time is correct (incase the workstation is out)

i wrote a c# program to interogate it [ATTACH=CONFIG]54040[/ATTACH]

 

this is the basic content of the sign in script.

 

 

 

obviously that doesnt help with previous ones... but its probably worth setting something up we use this all the time....

 

You do almost exactly what I do, including the c# application to go with it!

 

 

I can vouch that this is a very powerful means of querying logon/logoff events and reporting on them. I have a couple of Powershell scripts to report on different things within the database that I can run to help diagnostics. I find it useful to to see how much use a suite gets or if a member of staff has actually logged off and on again!

 

As far as seeing existing goes, querying the event log with Powershell seems to be the best way of doing it simply, though it's not perfect.