Checking Logon times

[ugman69]

Can anyone tell me if there is a way to check logon and logout times for users on multiple days on a Windows system?

Thank you for any help...

 

[dberg35]

Event Viewer has a security log it keep of users that log in but not out.

 

[captaincrunch00]

Well, you can set your auditing settings to record a setting when they log in or out, or both.

 

[ugman69]

I checked the event viewer, and it didn't list anything for when I had logged in this morning, and as far as the auditing settings, unfortunately, I don't know how to do that. Can anyone lead me through it?

Thank you

 

[captaincrunch00]

Start->Settings->Control Panel

Administrative Tools
Local Security Policy (but if this is a domain you should have a domain-wide policy set)

Expand the "Local Policies" and then the "Audit Policy" and you'll see the things you want or do not want to audit.

The one you want is "Audit Logon Events" and you want to show failure as well as success, that way you'll see anytime anyone logs into that server it'll make a hit in the security log.

 

[WhoKilledKenny]

Make sure you check all DC's for the record in the Event log. Only the DC that authenticated you will have the record...

 

[ugman69]

Oh my, well, I think I've done all that right. Those logs are definately not something that is easy to understand. I'm still not sure if it is telling me what I need to know, I'm assuming Logon Type 2 is what I should be looking for. Sure isn't as easy as it was back in my UNIX days.

Thanks...

If you have any more suggestions, please keep them coming, there has got to be an easier way.

 

[GlenJohnson]

Think you need to add a MMC snap-in. Read on...

http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/monitor/logonoff.mspx

Glen A. Johnson
If you like fun and sun, check out Tek-Tips Florida Forum
"Maybe this world is another planet's hell."
Aldous Huxley (1894-1963), English critic & novelist

 

[WhoKilledKenny]

Try this,

The Windows 2003 Resource Kit has a hidden .dll file called Acctinfo.dll. After registering the .dll with the following command, it will add a new property page, called Additional Account Info, to the user properties page in Active Directory Users and Computers. This property page shows Last Logon, Last Logoff, Last Bad Logon, and others. Even shows when password was last set and when it expires. This is not a Schema change and the tab can only be seen (in ADUC) from the computer that has registered the .dll. For info on how to install:

http://www.petri.co.il/view_additional_user_information_in_aduc.htm

PS - This tab is only seen when you drill through you AD structure. You will not see the tab if you use the search to find the user object - some type of bug.

 

[GlenJohnson]

The Windows 2003 Resource Kit has a hidden .dll file called Acctinfo.dll.

But, this is Windows 2000 server forum.... Does that exist in W2K?

Glen A. Johnson
If you like fun and sun, check out Tek-Tips Florida Forum
"Maybe this world is another planet's hell."
Aldous Huxley (1894-1963), English critic & novelist

 

[Seaspray0]

I've tried the acctinfo.dll on a 2003 DC running in 2000 mode and it worked. My suggestion is to load the admin.msi pack from the server CD to your client PC so you can pull up AD from the client. Then, register acctinfo.dll on the client and see if you get the property page. This was my method to test it (why endanger the DC when you don't need to?).

Start, Help. You'll be surprised what's there. A+/MCP/MCSE/MCDBA

 

[WhoKilledKenny]

Glen Good question, have not tested it on a 2000 Domain. Forgot which Forum I was in...

And I agree with Sea - don't install on a DC, do it from your workstation.

 

[NickFerrar]

Be aware that last logon is updated when a user unlocks a screensaver to.