Tracking Users with event viewer

[JonathanJoy]

Hi , Im using event viewer to track user logon times, and then developing a database application to analyse the data, is there a way of identifying the machine ID at the same time ?

 

REgards Jonathan

[sted]

wouldnt something like

 

echo -------Log user access to Machine-------
set mytime=%TIME:~0,-3%
echo %username%,%computername%,%mytime%,%date% >> \\server\log$\userlog.txt

be easier just dumps the info a csv file on the server just add it to logon scripts and if you want logoff as well same with logoff (though id be tempted to add logon and logoff to the scripts

Edited July 16, 2009 by sted

[Geoff]

Also if your using FOG, the client agent has a login/logout tracker.

[Arthur]

Sounds like a perfect use for Windows Event Forwarding. Having all the event logs in one place should make analysis quicker/easier and negate the need for a database wouldn't it?

[michaelf]

A second vote for sted's suggestion. We use the same system but to make things more manageable (and to avoid having one huge log file) we have seperate log files for each computer and user and have the script write to both the computer log and the user log at each logon.

[OutToLunch]

If you're going to try and build it from the Event Log, have a look at logparser.exe one of the Microsoft tools - you already have the database in the form of the Event Log, you just need a tool to query it