How to audit computer users from login on and login off of the computer

How to audit computer users from login on and login off of the computer

I believe most of the Geeks who are working in either SBS or MNC does have certain concerns in auditing users. With the below scripts it will assist you to do.

Such ideas can be implement via Group policy.

Kindly follow below steps:

1) Enable auditing on the Domain controller.

2) Access your group policy management console. Either gpedit.msc or GPMC
navigate to computer configuration/windows settings/Security Settings/local policies/auditing policies

Select  <audit account logon>

Else you may do it this way like what I normally do.

Create a logon script >
echo %date%,%time%,%computername%,%username%,%sessionname%,%logonserver%>>\\server\sharename$\logon.log

Create a logoff script
echo %date%,%time%,%computername%,%username%,%sessionname%,%logonserver%>>\\server\sharename$\logoff.log

Script options can be powered by WMI/ADSI to query each Domain controller for logon and logoff events.
Sort by: Published Date | Most Recent | Most Useful
Comments
  • Nice... i didn't know WMI could do that ?

Page 1 of 1 (1 items)