After Hours



Audit a specific user logins to network

By BigRedDog ·
Tags: Off Topic
I need to be able to audit one specific user's login to our network and record the dates and times that they log into the network and also when they logout. We have a Windows 2003 domain with active directory. Is there a easy way to do this for a specific user only? (I read the TechRepublic article on doing it for all users via a Group Policy) Is there a third party utility (free or cheap to buy) to do this?

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Answers

Collapse -

Yes there is

by Tig2 In reply to Audit a specific user log ...

But I am the wrong one to ask. There are better folks here for this.

I am answering so that this question doesn't get buried.

Collapse -

Try this

by Jacky Howe In reply to Audit a specific user log ...

Create A hidden share on the file server EG: Trace$. Call this from the users logon script. You may have to modify it. I originally used this with 98 on a nt4 domain. It has been modified a couple of times. Edit: Forgot to let you know that you will have the Username, Computername and Time of logon. It should keep adding to the file.

@echo off
echo %computername% > %username%.txt
type c:\%username%.txt >> \\"server"\trace$\%username%.txt
echo y|net time \\"server" /set >> \\"server"\trace$\%username%.txt
del c:\%username%.txt

Collapse -


by Tig2 In reply to Try this

Thanks for providing a good answer. I knew there was one, just couldn't think of it and didn't want the poor guy buried!

If I could rate you as helpful, I would!

Collapse -


by Jacky Howe In reply to Try this

noticed echo y|net time \\"server" /set >> \\"server"\trace$\%username%.txt

should have a space after the pipe.

echo y| net time \\"server" /set >> \\"server"\trace$\%username%.txt

It took a while to find this one Tigg. Comes with getting old i suppose.

Collapse -

Thanks, But.....

by BigRedDog In reply to Try this

Thanks for the idea but it seems your routine requires a unique login.bat for that user and will only log the logins to the network, not also log the loguts (so I can know how long they were on the system).
What I need this for is to track the amount of time an outside consultant is logged onto our network, to give me a rough idea of how many hours he is supposed to be working (I know he can login and not do anything.).

Collapse -


by Jacky Howe In reply to Audit a specific user log ...

add it to the local security policy. Run it at log off.

Collapse -

Logon reporter

by Jedwards33 In reply to Audit a specific user log ...

Yes, I definitely recommend the netwrix logon reporter. It?s free and it provides the information necessary to audit successful and failed logon attempts.

Related Discussions

Related Forums