locked
Monitoring User Logon Time RRS feed

  • Question

  • Hi Experts,

    Is it possible to monitor the time taken by each user to successfully logon into their client machines?

    What is mean is the time user enters their credentials and hits enter to the time the desktop window opens up.

    Regards,

    Prajul

    Wednesday, August 20, 2014 2:37 PM

Answers

  • Hi Prajul,

    The logon event for Windows 7 and above is 4624. To know what are the exact event IDs, we can logon to the computer, and then check event viewers for event IDs.

    And here is a link that could be helpful for you, please go through it:

    http://aymanstechblog.blogspot.kr/2013/01/scom-acs-user-logon-report.html

    Please Note: Since site is not hosted by Microsoft, the link may change without notice. Microsoft does  not guarantee the accuracy of this information the web.

    Regards,

    Yan Li


    Regards, Yan Li



    • Edited by Yan Li_ Friday, August 29, 2014 4:56 AM add info
    • Marked as answer by Yan Li_ Monday, September 1, 2014 1:42 AM
    Monday, August 25, 2014 8:53 AM

All replies

  • Hi 

    Try this:

    Dsquery * domainroot -filter "(&(objectCategory=Person)(objectClass=User)(samaccountname=MyName))"  –attr name lastLogonTimeStamp 

    Wednesday, August 20, 2014 2:41 PM
  • This post by Stefan Stranger should help you

    http://blogs.technet.com/b/stefan_stranger/archive/2009/12/10/user-logon-time-report-for-operations-manager-2007.aspx


    Blog: http://theinfraguys.com

    Follow me at Facebook The Infra Guys Facebook Page

    Please remember to click Mark as Answer on the answer if it helps you in anyway

    • Proposed as answer by Michael Skov Thursday, August 21, 2014 6:16 AM
    Wednesday, August 20, 2014 3:01 PM
  • Hi Michael,

    Thanks a lot for your response.

    this is exactly what i was looking for... hopefully i hit success on this...

    I find the event ID we get are different.

    Regards,

    Prajul

    Thursday, August 21, 2014 8:14 AM
  • Hi Prajul,

    The logon event for Windows 7 and above is 4624. To know what are the exact event IDs, we can logon to the computer, and then check event viewers for event IDs.

    And here is a link that could be helpful for you, please go through it:

    http://aymanstechblog.blogspot.kr/2013/01/scom-acs-user-logon-report.html

    Please Note: Since site is not hosted by Microsoft, the link may change without notice. Microsoft does  not guarantee the accuracy of this information the web.

    Regards,

    Yan Li


    Regards, Yan Li



    • Edited by Yan Li_ Friday, August 29, 2014 4:56 AM add info
    • Marked as answer by Yan Li_ Monday, September 1, 2014 1:42 AM
    Monday, August 25, 2014 8:53 AM