windows 2008 server as terminal srv

[Krystian81]

HI,

I very need script or tip how to write it

script to show who and when was logging into this machine
I know that this is available in security event log but there is millions of entries and I "only" need who and when.

regards
Krystian

 

[Geates]

you can load the security log with vbs and parse the data you need. You can also pick out the relevant entries by specifiying the logon event code: 4648.

strComputer = "."
set objWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
set colEvents = objWMI.ExecQuery("Select * from Win32_NTLogEvent Where Logfile = 'Security' and eventcode = '4648'")

for each objEvent in colEvents
    wscript.echo "Computer Name: " & objEvent.ComputerName & vbNewLine _
               & "Event Message: " & objEvent.Message & vbNewLine _
               & "Audit Time: " & objEvent.TimeWritten & vbNewLine
next

-Geates

"I do not offer answers, only considerations."
- Geates's Disclaimer

http://raqxtr.sstar.com/caspdoc/html/vbscript_language_reference.htm

 

[guitarzan]

You might also want to try the relevant Server forum, such as forum1674. For example, you could create a logon (and also a logoff) script that logs the user and date/time, etc.