Home | Blog | Software | Reviews and Features | Forum | Help | Donate | About us
topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • December 06, 2016, 06:11:13 AM
  • Proudly celebrating 10 years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Author Topic: where to find user login logs?  (Read 3996 times)

techidave

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 1,012
    • View Profile
    • Donate to Member
where to find user login logs?
« on: November 19, 2011, 04:41:53 AM »
I am running Win7 Pro SP1(at home) and I am trying to find out when different users login and logoff.

I have Parental Controls setup for one of my kids but it seems he is always on past his logoff time.

I have looked in Event Viewer but it gives the SID for the user and not the name.   :(

In googling this, I have come across using "quser" and "netuser" and then adding the username after them.  for example, quser dave or netuser dave.

quser only seems to give info on the current logged in user.  netuser will give last time he logged in but not when he logged out.  Better yet would be to find all the login and logoff times for a certain user.

is there a way to do this?  Perhaps a coding snack could be made?

Thanks
Dave

40hz

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 11,768
    • View Profile
    • Donate to Member
Re: where to find user login logs?
« Reply #1 on: November 19, 2011, 06:42:45 AM »
Can't remember where I learned this one, but it's pretty easy to do.

First, decide what you want to name your log file and where you want to save it.

For simplicity's sake, I'll use the the name usertimes.log and store it in the root of C for this example. (i.e. C:\usertimes.log) Same goes for the two scripts we'll be creating. This is only for illustration purposes. You'll likely want to store this stuff elsewhere - and you'll need to enable sharing on the folder you put them in due to Windows access restrictions.

--------------------------------------------------------------------------------
Important Note: When you create these two scripts, first make a new folder somewhere and share it with your HOMEGROUP. Set share permissions to Read/Write for the group. If you don't, only your account's times will get recorded. You can optionally make this folder a hidden share  if you feel it's necessary.

--------------------------------------------------------------------------------
a) Create a folder and share it with your homegroup. Give homegroup read/write access to this folder.

b) Navigate to your new folder, open a text editor, and enter (or copy/paste and edit) this text, and save it as: login.cmd

echo logon %username% %computername% %date% %time% >> C:\usertimes.log


c) Next, do the same with this string and save it as: logoff.cmd

echo logoff %username% %computername% %date% %time% >> C:\usertimes.log

You might have noticed the only difference is that login has been change to logoff in the second script. You may also want to omit %computername% since your users are all logging onto the same PC. (Old sysadmin habits die hard. ;D )

d) Now you have two scripts which copy login and logoff data to a file called usertimes.log in your C root.

You can use Group Policy to invoke these scripts since Windows has already conveniently included two policy objects for you to do that.

Open the policy editor and navigate to: User Configuration>Windows Setting>Scripts where you'll find two unconfigured scripts for logon and logoff.

Doco2.gifwhere to find user login logs?

Double-click on each script and configure them for the scripts you just created:

doco3.gifwhere to find user login logs?

Voila! Done.

Now all login and logoff times will be appended to the usertimes.log file:

Doco1.gif


Piece of cake right?  :) :Thmbsup:



« Last Edit: November 19, 2011, 07:59:16 AM by 40hz »

techidave

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 1,012
    • View Profile
    • Donate to Member
Re: where to find user login logs?
« Reply #2 on: November 19, 2011, 09:04:31 AM »
right!  i will check it out later on.  :up:

4wd

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 4,474
    • View Profile
    • Donate to Member
Re: where to find user login logs?
« Reply #3 on: November 19, 2011, 07:52:25 PM »
If you want something a little more detailed, (eg. with logon/logoff reasons), then you could try a little filtering of the Windows Security Event log as detailed here: Tracking user logons and logoffs with Event Viewer (about a quarter way down the page)

w7evt07.jpg

EDIT: Just noticed what you said about the Event log only giving an SID, however in my Security log it gives the name as well.

2011-11-20_12-59-12.jpg

Addendum: A program I knew I'd seen before but forgotten about: Event Log Explorer Free for personal use up to 3 computers, just register to get your license key.

2011-11-20_13-16-28.jpg

You can set up a filter and then save it for use later.
« Last Edit: November 19, 2011, 08:24:58 PM by 4wd »

techidave

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 1,012
    • View Profile
    • Donate to Member
Re: where to find user login logs?
« Reply #4 on: November 20, 2011, 06:12:04 AM »
Well, I have spent some time playing around with the suggestions.  In a nutshell,  the Event Log Viewer has been the easiest to set up and use.

4wd's suggestion of using a customize filtering option worked but didn't show the recent logoff events but event log viewer did. as matter of fact, it didn't show a logoff event after 9-11-2011.  couldn't figure that one out.

as for 40's scripting method, it also works.  but i will have to wait until I get more users on before knowing which method is going to work the best for me.

My Parental Controls don't seem to be working even though it is setup and eventviewer will actually show it initiated a log off.  Hmmm.  He is still logged in well after the logoff time.

I did find a service called parental control but it said its used in Vista for backwards compatiblity (whatever that means).  it by default, is turned off.   I am using Win 7 Pro.

techidave

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 1,012
    • View Profile
    • Donate to Member
Re: where to find user login logs?
« Reply #5 on: November 21, 2011, 05:15:57 AM »
After a day of different users logging in to the computer, the Event Log Explorer is showing correctly.  The scriping method that 40hz came up with only shows the users that have administrative rights on the computer.   :(

By using 40hz's method, I can view what I want and not have to wade through all the other stuff that Event Log Explorer is showing.

40hz

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 11,768
    • View Profile
    • Donate to Member
Re: where to find user login logs?
« Reply #6 on: November 23, 2011, 09:58:53 AM »
After a day of different users logging in to the computer, the Event Log Explorer is showing correctly.  The scriping method that 40hz came up with only shows the users that have administrative rights on the computer.   :(

By using 40hz's method, I can view what I want and not have to wade through all the other stuff that Event Log Explorer is showing.

If you don't create a share for all members of your homegroup, and allow read/write access to it by the group, then yes, only the users with admin rights will log times.

In the example I posted, the second UID (John) was not an admin account. I tested it before posting just to be sure.  ;)

Note: not something I came up with, but thanks anyway. Variations of this method have been kicking around since W2K Server. Group policies just made things like this simple and bulletproof once Microsoft incorporated them into their OS.  8)
« Last Edit: November 23, 2011, 10:08:33 AM by 40hz »

techidave

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 1,012
    • View Profile
    • Donate to Member
Re: where to find user login logs?
« Reply #7 on: November 24, 2011, 05:19:08 AM »
well, I just checked and while I had shared the folder, i forgot to give it write access.  Will check again tomorrow after a day of various people logging on and off.

techidave

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 1,012
    • View Profile
    • Donate to Member
Re: where to find user login logs?
« Reply #8 on: November 26, 2011, 05:02:51 AM »
its funny that I never noticed the "share with" when I right clicked the folder until today.  But when I went back and re-read 40hz's original instructions, it made perfect sense.   :-[

Like i keep telling my teachers, "You have to read (really read) what is on the screen in front of you.  It is telling you what you need to know (most of the time).  And don't think you know (assume) what it is saying!"   :D  :P

I am guilty... again of not following my own instructions.  READ the instructions (40hz) David, READ the instructions!