Logon Tracker

[Bankesy]

Good afternoon all,

 

Does anybody have any experience with setting up or using a simple logon tracker to trace which accounts are being logged onto which device at what time, please?

 

In my last place I know we had something simple that just created text files with this info but never knew how it worked.

 

Any help is appreciated, as always.

Thank you

[jthompson]

Quick and dirty method is to use bat files set as logon and logoff scripts. The share that they write to needs to allow everyone to modify files, which is something to consider.

 

For logons the bat file would be:

 

echo Log In	%Date%	%TIME%	%USERNAME% >> \\path\to\share$\Computers\%COMPUTERNAME%.log
echo Log In	%Date%	%TIME%	%COMPUTERNAME% >> \\path\to\share$\Users\%USERNAME%.log

 

For logoffs:

 

echo Log Off	%Date%	%TIME%	%USERNAME% >> \\path\to\share$\Computers\%COMPUTERNAME%.log
echo Log Off	%Date%	%TIME%	%COMPUTERNAME% >> \\path\to\share$\Users\%USERNAME%.log

 

You'll then get log files per computer and per user that show logon and logoff history. Nice and easily readable for quick reference by admins, but bear in mind that all users would have write privileges.

[mbedford]

Logon script that writes to a SQL table on a server.  Also do the same for logoff, same table. 

 

User 1 - ON - 14/10/2025 1115

User 1 - OFF - 14/10/2025 1135

 

etc

 

You could get ChatGPT or CoPilot to throw together the code for script in seconds.  If you want to be more security focused, use Stored Procedures (MSSQL) or whatever they are called in MySQL to ensure that the user can only send new entries to the table and not do any Selects or Inserts etc..

 

Thanks

Edited October 14, 2025 by mbedford

[MCPearson]

If it's Windows, you can retrieve logon data from the Security event log with Powershell. Something like:

 

$LogonEvents = Get-WinEvent -FilterHashtable @{
    LogName = 'Security';
    ID = 4624;
}

You can then filter out the noise from impersonations etc. by just querying the properties of the event.

After that, you can write it to a csv, db file, etc. I think there's ways to integrate with MySQL if you need. This way you can run the script under SYSTEM or whatever other account without giving users write privileges.

[webman]

I made something for this purpose when I worked in a school, with a web-based interface. It's available on GitHub if you want to use it - https://github.com/craigrodway/logintracker. It will require some updating though!

Edited October 14, 2025 by webman

[altecsole]

We have PowerShell logon and logoff scripts that writes to SQL Express, running on one of our servers. 

 

[3s-gtech]

Similar to webman's system, we made an exe that runs on logon and updates a MySQL table. I then developed a web interface that lets me drill down on who, when, where. It's great, but needs a web server instance.