Auditing who logs on and where

  • Thread starter Thread starter JAQK
  • Start date Start date
J

JAQK

Is it possible to audit logon events in such a way that the workstations
where they log on are recorded in the event log ?
 
JAQK said:
Is it possible to audit logon events in such a way that the workstations
where they log on are recorded in the event log ?
Click to expand...

You could use logevent.exe from the Windows Resource Kit:

logevent "%date% %time:~0,5% %UserName%"

If your number of workstations is small and you require a
central log file, you could also insert this single line into your
logon script:

echo %date% %time:~0,5% %UserName% %ComputerName% >>
\\YourServer\Logs\Logon.txt
 
Hi, thanks, but it's not clear at all how to use this utility and how it can
be made to
identify or display the workstation from where the domain logon was
initiated.

Any helpful suggestion would be greatly appreciated.
 
Which utility? I suggested two solutions!

If it's psexec.exe then please download it, run
psexec /?, read what it says on the screen, then
post again with any questions you might have.
 
We use kix32.exe with the following script as part of the domain logon
script:

$filename='\\servernamehere\wslog\'+@WKSTA+'.log'
Open(1, $filename, 5)
WriteLine(1,'@WKSTA,@USERID,@DAY,@DATE,@TIME,MAC=@ADDRESS,IP=@IPADDRESS0,@LSERVER'
+ Chr(13) + Chr(10))
Close(1)

This records who logs on to which workstation and when.

HTH

Marcus Burrows
 
Back
Top