Home / server / Questions / 118984
Accepted
blueberryfields
Asked: 2010-03-04 15:27:32 +0800 CST

What is a quick way to report login/logout times on Windows 2003?

  • 772

I have about a dozen servers, and I am looking to quickly find out all of the login/logout times, for a subset of users, for all servers, during January.

Is there a quick, easy way to get this information (faster and easier than manually combing through the security logs)?

I would rather not replicate any work - are there any publicly posted tools or scripts that already implement a solution to this problem?

windows-server-2003 log-files security

2 Answers

  1. Best Answer

    There are a number of ways to do this, all involving the application of filters to the logs, which you can also do using the event log viewer.

    There are many scripted solutions for this, or you can create your own in just about any language. I use Perl to process the logs each night, grabbing just the entries for the last 24 hours, and export the desired data to a MySQL database, from which I create reports using Access.

    • 1

  2. You can do a simple Event Log dump with powershell:

    get-eventlog -LogName Security | convertTo-csv > C:\SecurityLogAudit.csv

    Then open the csv in excel, parse the events you want to look for, and then graph away.

    • 0