Auditing who logs on and where

[JAQK]

Is it possible to audit logon events in such a way that the workstations
where they log on are recorded in the event log ?

 

[Pegasus]

Is it possible to audit logon events in such a way that the workstations
where they log on are recorded in the event log ?

You could use logevent.exe from the Windows Resource Kit:

logevent "%date% %time:~0,5% %UserName%"

If your number of workstations is small and you require a
central log file, you could also insert this single line into your
logon script:

echo %date% %time:~0,5% %UserName% %ComputerName% >>
\\YourServer\Logs\Logon.txt

 

[JAQK]

Hi, thanks, but it's not clear at all how to use this utility and how it can
be made to
identify or display the workstation from where the domain logon was
initiated.

Any helpful suggestion would be greatly appreciated.

 

[Pegasus \(MVP\)]

Which utility? I suggested two solutions!

If it's psexec.exe then please download it, run
psexec /?, read what it says on the screen, then
post again with any questions you might have.

 

[coalbiter]

We use kix32.exe with the following script as part of the domain logon
script:

$filename='\\servernamehere\wslog\'+@WKSTA+'.log'
Open(1, $filename, 5)
WriteLine(1,'@WKSTA,@USERID,@DAY,@DATE,@TIME,MAC=@ADDRESS,IP=@IPADDRESS0,@LSERVER'
+ Chr(13) + Chr(10))
Close(1)

This records who logs on to which workstation and when.

HTH

Marcus Burrows