Home / server / Questions / 727686
Accepted
drg
Asked: 2015-10-09 10:23:33 +0800 CST

Counting Windows Users Who Have Logged on to a Server

  • 772

Is there a way to programmatically collect a list of users who have logged on to a Windows server (specifically 2008 R2) within the past 30 days or between two dates? There are 2 active directory servers and all users are members of the same domain.

My end goal is to automatically get a list of unique users for each of our servers for SPLA reasons.

active-directory

2 Answers

  1. Best Answer

    This is manual, rather than via program, but you can make a filter in Event Viewer that will show just your login events. Right click on the Custom Views folder and choose the Create Custom View option. Unfortunately, for this filter you have to edit the XML. Here is what the XML for the filter would look like:

    <QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID=4624)]] 
      and 
      *[EventData[Data[@Name='LogonType'] and (Data='2' or Data='10' or Data='11')]]
    </Select>
    <Suppress Path="Security"> 
       *[EventData[Data[@Name='TargetDomainName'] and  (Data = 'Window Manager')]]
    </Suppress> 
  </Query>
</QueryList>

    You may want to edit this to include Logon Type 7 as well (Unlocking a locked session). More information on Logon Type Codes is available here:

    http://www.windowsecurity.com/articles-tutorials/misc_network_security/Logon-Types.html

    Note that this does NOT filter by date range: only logins. But once you've narrowed that part down, it's easy to browse the date range in Event Viewer manually.

    Unfortunately, this filter did not work for me when I used the "Connect to another computer" option, even with the firewall turned off.

    • 2

  2. There is not easy way. Combing thru Security logs is the first thing come to mind. You are looking for event ID 4624. Pay attention to logon type(2,10,11 if your intention is to count interactive logons).

    Depending on how fast are security log entries generated and how big your log is, log may be overwritten before 30 days cycle.

    It's better to enforce a login script that does the count to a central place.

    • 1