After Hours

Ask something
Question Locked

Audit a specific user logins to network

0 helpful
8 replies

by bigreddog

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I need to be able to audit one specific user's login to our network and record the dates and times that they log into the network and also when they logout. We have a Windows 2003 domain with active directory. Is there a easy way to do this for a specific user only? (I read the TechRepublic article on doing it for all users via a Group Policy) Is there a third party utility (free or cheap to buy) to do this?

8 replies

by tig2

But I am the wrong one to ask. There are better folks here for this.

I am answering so that this question doesn't get buried.

by rob miners

Create A hidden share on the file server EG: Trace$. Call this from the users logon script. You may have to modify it. I originally used this with 98 on a nt4 domain. It has been modified a couple of times. Edit: Forgot to let you know that you will have the Username, Computername and Time of logon. It should keep adding to the file.

@echo off
c:
echo %computername% > %username%.txt
type c:\%username%.txt >> \\"server"\trace$\%username%.txt
echo y|net time \\"server" /set >> \\"server"\trace$\%username%.txt
del c:\%username%.txt

by tig2

Thanks for providing a good answer. I knew there was one, just couldn't think of it and didn't want the poor guy buried!

If I could rate you as helpful, I would!

by rob miners

noticed echo y|net time \\"server" /set >> \\"server"\trace$\%username%.txt

should have a space after the pipe.

echo y| net time \\"server" /set >> \\"server"\trace$\%username%.txt

It took a while to find this one Tigg. Comes with getting old i suppose.

by bigreddog

Thanks for the idea but it seems your routine requires a unique login.bat for that user and will only log the logins to the network, not also log the loguts (so I can know how long they were on the system).
What I need this for is to track the amount of time an outside consultant is logged onto our network, to give me a rough idea of how many hours he is supposed to be working (I know he can login and not do anything.).

by rob miners

add it to the local security policy. Run it at log off.

by jedwards33

Yes, I definitely recommend the netwrix logon reporter. It?s free and it provides the information necessary to audit successful and failed logon attempts.
J

This discussion is closed to new replies.