login logout time trace

Clarifications

You can set up a GPO to audit account logon events. This should provide you with the info you're looking for...who logged on when and to what machine.

This section goes into your logon script.

C:
set timer=C:\%computername%.txt
echo %computername% >%timer%
echo %username% >>%timer%
echo %date% >>%timer%
echo %time% >>%timer%

call c:\comp.bat

============================
Create a Batch File called Comp.bat with the following information and place it in the root dir on each workstation.
Redirect the file to a hidden share on the server.EG. type %computername%.txt >> \\servername\wslogs$\%computername%.txt
@echo off
type %computername%.txt >> \\servername\wslogs$\%computername%.txt
del c:\%computername%.txt

===============================
Output will look like this

WS1BOSS
Rob
Fri 17/02/2006
8:14:28.43
WS1BOSS
Rob
Fri 17/02/2006
8:16:13.39

This is similar to what i had to do at a High School that i worked for to stop vandalism.
It was a lot quicker to find the culprit.

http://help.lockergnome.com/windows2/track-time-employee-log-log-ftopict479370.html

You could also add this to logon and logoff scripts specified by a Group Policy.

Create A hidden share on the file server EG: Trace$. It was origianlly called from the users logon script. You may have to modify it. I originally used this with 98 on a nt4 domain.

You will have the Username, Computername and Time of logon. It should keep adding to the file with the Logon ID.

@echo off
c:
echo %computername% > %username%.txt
type c:\%username%.txt >> \\"server"\trace$\%username%.txt
echo y| net time \\"server" /set >> \\"server"\trace$\%username%.txt
del c:\%username%.txt