Question : Windows Server 2003 Logon/Logoff Log Report

We received a great tip/solution (see at bottom) from "My Username (HTH)" for capturing logon/logoff info. However, after awhile, we found that we still have the following issues:

1. Prefer 12 hour clock, not militasry time, and don’t need seconds
2. Would like to separate Day from Date
3. For one of our users, it does not show the day, but does show date and time.
4. Not sure why it’s not showing some computers, about 1/3 of them.

------
The examples are logon and logoff scripts. Here's the steps you need to implement it.

- Create a share on the server (if you add the $ sign at the end of the share it will be hidden) and make sure every user has the ability to write to it
- Create two scripts using the above code I provided and save them to the NETLOGON share on the SBS server. (paste the text in Notepad and save it as a .bat file - be sure to change the \\server\share$\ to your actual server name and share name)
- Open the GPMC (Start -> Run -> gpmc.msc)
- Right-click the Default Domain Policy and select Edit
- Expand "User Configuration\Windows Settings\Scripts"
- Double click Logon and add the logon script you saved earlier. Do the same with Logoff.

That should do it. Next time the users refresh their Group Policy they'll start logging their logon and logoff to that CSV file located at \\server\share$\logonEvents.csv.

And this won't generate as much information as the Security event log. You'll get one entry per logon and logoff.

HTH

Answer : Windows Server 2003 Logon/Logoff Log Report

using VBS allows a lot more control over formatting. add it to the GPO logon /logoff the same as a .bat file.

ive posted a piece of one of my logon scripts that copies files across but also logs it's actions.
save it as LogonRecord.vbs

add a command such as

"LogonRecord.vbs LOGON" and "LogonRecord.vbs LOGOFF" to the logon and logoff sections of the GPO respectively.

this will add a line like

Testuser, THEIRPC, 20100603-2002 , LOGON to the csv file.

i prefer to use named months to avoid US/Europe confusions but VBS is not so good at formatting that.

to test, save the file and then run manually from a desktop.

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:



'---------------------------------------
' Script to track logon and logoff events
' 1  03.June.2010  robber
''''''''''''''''''''''''''''''''''
' Constants for opening files
''''''''''''''''''''''''''''''''''
Const OpenFileForReading = 1
Const OpenFileForWriting = 2
Const OpenFileForAppending = 8
	dim a, src , sVers 
	dim fs
	
'--- set up files & log ---------
'change to suit domain setup... the sysvol area can be written to by startup & logon scripts
const LogFldr="\\SBSSERVER\SYSVOL\mydomain\logs\"       
lf = "logonevents.csv"

	actionX = WScript.Arguments(0)  'assume the first argument is the action being performed'
	
	sVers=""
    
    'configure a consistent , orderable date time   YYYYMMDD-HHNN
	datetime=Year(now()) & Right("0" & Month(now()), 2) & Right("0" & Day(now()), 2) & "-" & Right("0" & Hour(now()), 2) & Right("0" & Minute(now()), 2) '& Right("0" & Second(now()), 2)

'or use a date format Xcel will convert to DateTime value
    'configure a consistent , convertable date time   YYYYMMMDD-HHNN
	datetime=Year(now()) & MonthName(Month(now()),True) & Right("0" & Day(now()), 2) & "-" & Right("0" & Hour(now()), 2) & Right("0" & Minute(now()), 2) '& Right("0" & Second(now()), 2)

	' Create the Shell etc objects
    Set oShell = CreateObject("WScript.Shell")
	Set oNet = CreateObject("WScript.Network")
	Set oFSO = CreateObject("Scripting.FileSystemObject")  
	
	' write to Log 
	Set flf = oFSO.GetFile(logfldr & lf)
	Set tslf = flf.OpenAsTextStream(OpenFileForAppending)
  	
	tslf.WriteLine ( onet.UserName & " , " & Onet.ComputerName  & " , " & WeekdayName(Weekday(Now)) & " , " & Datetime & " , " & ActionX)
	tslf.Close
'------ end ---
	set onet = nothing
	set oShell = nothing
	Set oFSO = Nothing

wscript.quit