Click here to get back home

capture and record login times

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
capture and record login times karl 12-08-2005
Posted by karl on December 8, 2005, 10:50 am
Please log in for more thread options
I am trying to find out how I can capture what time users log into
their machines in the morning on a windows 2000 domain.

The awkward part is that most of the users just lock their pcs and come
back in the morning and unlock them and I dont know how to force users
off the network to force a login again in the morning. If the truth be
told, I wouldn't know how to capture the login time and record it even
if they had restarted their pc anyway.

If anyone knows how to force users off the network and how to capture
login times and record them, preferably to a database, I would
appreciate it greatly.


Posted by Steven L Umbach on December 9, 2005, 1:08 am
Please log in for more thread options
If you enable auditing of "account logon" events in Domain Controller
Security Policy for success and failure and auditing of "logon" events for
failure only and then enable auditing of logon events in Domain Security
Policy you would see domain logons in the security logs of domain
controllers for domain users and also see logon events in the security log
of the domain workstation that the user logs onto and also a logon events
when the user unlocks his computer.

To force users to logoff you could try using the Resource Kit logoff
screensaver called winexit.scr to logoff a users computer after a certain
period of inactivity though offhand I don't know how well it would work if
the computer is locked but would be easy enough to test out. You could use
Group Policy to configure the winexit.scr screensaver and use Group Policy
"startup" script to distribute it to their computers. Winexit.scr would have
to first be configured to shut down the user's applications before it is
distributed to the user's computers which may result in a loss of data. You
also could have a computer use policy that requires users to logoff their
computer at the end of a work shift and use the information in the security
log of their workstation for disciplinary purposes if they do not
omply. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;314999 --- works
for W2K also
http://support.microsoft.com/default.aspx?scid=kb;en-us;156677

>I am trying to find out how I can capture what time users log into
> their machines in the morning on a windows 2000 domain.
>
> The awkward part is that most of the users just lock their pcs and come
> back in the morning and unlock them and I dont know how to force users
> off the network to force a login again in the morning. If the truth be
> told, I wouldn't know how to capture the login time and record it even
> if they had restarted their pc anyway.
>
> If anyone knows how to force users off the network and how to capture
> login times and record them, preferably to a database, I would
> appreciate it greatly.
>



Similar ThreadsPosted
Limiting Login Times on Particular Machines May 6, 2006, 8:08 pm
RDP Dictionary Attack Logon Failures - Capture Internet IP Address? July 30, 2007, 8:03 am
Been hacked about 4 times now. Wanna be the 5th? June 2, 2006, 8:59 pm
Specify Allowed Times for users to log on April 10, 2008, 11:17 pm
673 Failure Audit appears several times per day December 10, 2005, 11:46 pm
Login Script Question - Failed Login Count, Location, and Method October 5, 2005, 6:28 pm
Smart Card Login + Certificate Login to AD -> Lost smart card December 15, 2005, 10:03 pm
login October 19, 2007, 4:46 pm
Login Auditing June 17, 2005, 11:05 am
Login Interactively June 23, 2005, 8:20 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap