where to find user login logs?

[techidave]

I am running Win7 Pro SP1(at home) and I am trying to find out when different users login and logoff.

I have Parental Controls setup for one of my kids but it seems he is always on past his logoff time.

I have looked in Event Viewer but it gives the SID for the user and not the name. 

In googling this, I have come across using "quser" and "netuser" and then adding the username after them.  for example, quser dave or netuser dave.

quser only seems to give info on the current logged in user.  netuser will give last time he logged in but not when he logged out.  Better yet would be to find all the login and logoff times for a certain user.

is there a way to do this?  Perhaps a coding snack could be made?

Thanks
Dave

[40hz]

Can't remember where I learned this one, but it's pretty easy to do.

First, decide what you want to name your log file and where you want to save it.

For simplicity's sake, I'll use the the name usertimes.log and store it in the root of C for this example. (i.e. C:\usertimes.log) Same goes for the two scripts we'll be creating. This is only for illustration purposes. You'll likely want to store this stuff elsewhere - and you'll need to enable sharing on the folder you put them in due to Windows access restrictions.

--------------------------------------------------------------------------------
Important Note: When you create these two scripts, first make a new folder somewhere and share it with your HOMEGROUP. Set share permissions to Read/Write for the group. If you don't, only your account's times will get recorded. You can optionally make this folder a hidden share  if you feel it's necessary.

--------------------------------------------------------------------------------
a) Create a folder and share it with your homegroup. Give homegroup read/write access to this folder.

b) Navigate to your new folder, open a text editor, and enter (or copy/paste and edit) this text, and save it as: login.cmd

echo logon %username% %computername% %date% %time% >> C:\usertimes.log


c) Next, do the same with this string and save it as: logoff.cmd

echo logoff %username% %computername% %date% %time% >> C:\usertimes.log

You might have noticed the only difference is that login has been change to logoff in the second script. You may also want to omit %computername% since your users are all logging onto the same PC. (Old sysadmin habits die hard. )

d) Now you have two scripts which copy login and logoff data to a file called usertimes.log in your C root.

You can use Group Policy to invoke these scripts since Windows has already conveniently included two policy objects for you to do that.

Open the policy editor and navigate to: User Configuration>Windows Setting>Scripts where you'll find two unconfigured scripts for logon and logoff.

[attachthumb=#]

Double-click on each script and configure them for the scripts you just created:

[attachthumb=#]

Voila! Done.

Now all login and logoff times will be appended to the usertimes.log file:

[attach]

[techidave]

right!  i will check it out later on. 

[4wd]

If you want something a little more detailed, (eg. with logon/logoff reasons), then you could try a little filtering of the Windows Security Event log as detailed here: Tracking user logons and logoffs with Event Viewer (about a quarter way down the page)



EDIT: Just noticed what you said about the Event log only giving an SID, however in my Security log it gives the name as well.



Addendum: A program I knew I'd seen before but forgotten about: Event Log Explorer Free for personal use up to 3 computers, just register to get your license key.



You can set up a filter and then save it for use later.

[techidave]

Well, I have spent some time playing around with the suggestions.  In a nutshell,  the Event Log Viewer has been the easiest to set up and use.

4wd's suggestion of using a customize filtering option worked but didn't show the recent logoff events but event log viewer did. as matter of fact, it didn't show a logoff event after 9-11-2011.  couldn't figure that one out.

as for 40's scripting method, it also works.  but i will have to wait until I get more users on before knowing which method is going to work the best for me.

My Parental Controls don't seem to be working even though it is setup and eventviewer will actually show it initiated a log off.  Hmmm.  He is still logged in well after the logoff time.

I did find a service called parental control but it said its used in Vista for backwards compatiblity (whatever that means).  it by default, is turned off.  I am using Win 7 Pro.

[techidave]

After a day of different users logging in to the computer, the Event Log Explorer is showing correctly.  The scriping method that 40hz came up with only shows the users that have administrative rights on the computer. 

By using 40hz's method, I can view what I want and not have to wade through all the other stuff that Event Log Explorer is showing.

[40hz]

After a day of different users logging in to the computer, the Event Log Explorer is showing correctly.  The scriping method that 40hz came up with only shows the users that have administrative rights on the computer.  

By using 40hz's method, I can view what I want and not have to wade through all the other stuff that Event Log Explorer is showing.

If you don't create a share for all members of your homegroup, and allow read/write access to it by the group, then yes, only the users with admin rights will log times.

In the example I posted, the second UID (John) was not an admin account. I tested it before posting just to be sure.  

Note: not something I came up with, but thanks anyway. Variations of this method have been kicking around since W2K Server. Group policies just made things like this simple and bulletproof once Microsoft incorporated them into their OS.  

[techidave]

well, I just checked and while I had shared the folder, i forgot to give it write access.  Will check again tomorrow after a day of various people logging on and off.

[techidave]

its funny that I never noticed the "share with" when I right clicked the folder until today.  But when I went back and re-read 40hz's original instructions, it made perfect sense.  

Like i keep telling my teachers, "You have to read (really read) what is on the screen in front of you.  It is telling you what you need to know (most of the time).  And don't think you know (assume) what it is saying!"    

I am guilty... again of not following my own instructions.  READ the instructions (40hz) David, READ the instructions!