Announcement

Collapse
No announcement yet.

Logon and Logoff Report

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Logon and Logoff Report

    What is the easiest way to pull a report of all logons and logoffs for each user in my Active Directory domain? I presume I will need to look at each domain controller, but I am not sure the best way to do this.

  • #2
    Re: Logon and Logoff Report

    For all users your best bet would be our free utility DumpSec at http://www.systemtools.com/free_frame.htm

    When you run a user report, include Last Logon, and check the box to Show Last True Logon it will query all controllers and give you only the latest time found for each user.

    Comment


    • #3
      Re: Logon and Logoff Report

      Well this works for the most recent logon, but what I need for auditing purposes is a list of ALL LOGONS for a specified time period... usually one week's worth.

      Comment


      • #4
        Re: Logon and Logoff Report

        Unfortunately Windows doesn't keep a running log for you, but rather overwrites the value each time that user logs in.

        The only recommendation would be to check your security logs for this data. This assumes you are running auditing on your network.

        Comment


        • #5
          Re: Logon and Logoff Report

          I do have the security event logs configured. I guess my original question is how to extract this information and put it in a friendly format in the easiest way.

          Comment


          • #6
            Re: Logon and Logoff Report

            What you should be able to do is select your controllers in Hyena's right window, then right-click and choose Events->Filter Events.

            Choose Security Log and enter in the Event IDs for these events and click OK. Hyena will pull in matching events from the selected servers. From there you can dump the data from the right window to Excel for further sorting and reporting.

            Comment


            • #7
              Re: Logon and Logoff Report

              You can make a MSAcces report (at least in v6.2). Choose the event view that you would export and show it in right window, then you go to the menu: Tools -> Generate report (the report name confirms you that you go to make the event report unless put "Events" on Report Name field.
              Hyena exports the data into default DB hyenarpt.mdb, makes you a report and fill the event table with data.

              PD. sorry about my english :P

              Comment

              Working...
              X