Main Area and Open Discussion > Living Room

where to find user login logs?

(1/2) > >>

techidave:
I am running Win7 Pro SP1(at home) and I am trying to find out when different users login and logoff.

I have Parental Controls setup for one of my kids but it seems he is always on past his logoff time.

I have looked in Event Viewer but it gives the SID for the user and not the name.   :(

In googling this, I have come across using "quser" and "netuser" and then adding the username after them.  for example, quser dave or netuser dave.

quser only seems to give info on the current logged in user.  netuser will give last time he logged in but not when he logged out.  Better yet would be to find all the login and logoff times for a certain user.

is there a way to do this?  Perhaps a coding snack could be made?

Thanks
Dave

40hz:
Can't remember where I learned this one, but it's pretty easy to do.

First, decide what you want to name your log file and where you want to save it.

For simplicity's sake, I'll use the the name usertimes.log and store it in the root of C for this example. (i.e. C:\usertimes.log) Same goes for the two scripts we'll be creating. This is only for illustration purposes. You'll likely want to store this stuff elsewhere - and you'll need to enable sharing on the folder you put them in due to Windows access restrictions.

--------------------------------------------------------------------------------
Important Note: When you create these two scripts, first make a new folder somewhere and share it with your HOMEGROUP. Set share permissions to Read/Write for the group. If you don't, only your account's times will get recorded. You can optionally make this folder a hidden share  if you feel it's necessary.

--------------------------------------------------------------------------------
a) Create a folder and share it with your homegroup. Give homegroup read/write access to this folder.

b) Navigate to your new folder, open a text editor, and enter (or copy/paste and edit) this text, and save it as: login.cmd

echo logon %username% %computername% %date% %time% >> C:\usertimes.log


c) Next, do the same with this string and save it as: logoff.cmd

echo logoff %username% %computername% %date% %time% >> C:\usertimes.log

You might have noticed the only difference is that login has been change to logoff in the second script. You may also want to omit %computername% since your users are all logging onto the same PC. (Old sysadmin habits die hard. ;D )

d) Now you have two scripts which copy login and logoff data to a file called usertimes.log in your C root.

You can use Group Policy to invoke these scripts since Windows has already conveniently included two policy objects for you to do that.

Open the policy editor and navigate to: User Configuration>Windows Setting>Scripts where you'll find two unconfigured scripts for logon and logoff.

where to find user login logs?

Double-click on each script and configure them for the scripts you just created:

where to find user login logs?

Voila! Done.

Now all login and logoff times will be appended to the usertimes.log file:




Piece of cake right?  :) :Thmbsup:

techidave:
right!  i will check it out later on.  :up:

4wd:
If you want something a little more detailed, (eg. with logon/logoff reasons), then you could try a little filtering of the Windows Security Event log as detailed here: Tracking user logons and logoffs with Event Viewer (about a quarter way down the page)



EDIT: Just noticed what you said about the Event log only giving an SID, however in my Security log it gives the name as well.



Addendum: A program I knew I'd seen before but forgotten about: Event Log Explorer Free for personal use up to 3 computers, just register to get your license key.



You can set up a filter and then save it for use later.

techidave:
Well, I have spent some time playing around with the suggestions.  In a nutshell,  the Event Log Viewer has been the easiest to set up and use.

4wd's suggestion of using a customize filtering option worked but didn't show the recent logoff events but event log viewer did. as matter of fact, it didn't show a logoff event after 9-11-2011.  couldn't figure that one out.

as for 40's scripting method, it also works.  but i will have to wait until I get more users on before knowing which method is going to work the best for me.

My Parental Controls don't seem to be working even though it is setup and eventviewer will actually show it initiated a log off.  Hmmm.  He is still logged in well after the logoff time.

I did find a service called parental control but it said its used in Vista for backwards compatiblity (whatever that means).  it by default, is turned off.   I am using Win 7 Pro.

Navigation

[0] Message Index

[#] Next page