Announcement

Collapse
No announcement yet.

Logon Event ID and Report

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Logon Event ID and Report

    Hi,
    I need to make a report about some users and the time they logged on against a Win2003 Server.

    I was using the event viewer and while trying to filter some information, i'm not quite sure what Event ID to use regarding the Logon.

    Anybody knows what event id is used when a user logs in in a windows server? Any tool that can easily generate reports like these?

    Thank you very much!

  • #2
    Re: Logon Event ID and Report

    The Event ID I believe youre looking for is 528 (successful logon) and 540 (successful network logon).

    You could use a visual basic script to list all Event Codes in the Security Log, you just need to change the Event Code as appropriate. Just copy the below into a text file and save as a .vbs file extension.

    Code:
    strComputer = "."
    Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
    Set colLoggedEvents = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent Where Logfile = 'Security' and " _
                & "EventCode = '540'")
    For Each objEvent in colLoggedEvents
    strTimeWritten = objEvent.TimeWritten
    
        dtmTimeWritten = CDate(Mid(strTimeWritten, 5, 2) & "/" & _
            Mid(strTimeWritten, 7, 2) & "/" & Left(strTimeWritten, 4) _
                & " " & Mid (strTimeWritten, 9, 2) & ":" & _
                    Mid(strTimeWritten, 11, 2) & ":" & Mid(strTimeWritten, 13, 2))
    
        dtmDate = FormatDateTime(dtmTimeWritten, vbShortDate)
        dtmTime = FormatDateTime(dtmTimeWritten, vbLongTime)
    
    Wscript.Echo "Username: " & objEvent.User 
    WScript.Echo "Date: " & dtmDate
    WScript.Echo "Time: " & dtmTime
    Next
    To run the file, type the following form a command prompt

    Code:
    cscript filename.vbs
    MCSA 2000/2003

    Comment


    • #3
      Re: Logon Event ID and Report

      very nice, but you can also create a filtered view in the event viewer itself.
      "...if I turn out to be particularly clear, you've probably misunderstood what I've said” - Alan Greenspan

      Comment


      • #4
        Re: Logon Event ID and Report

        Yep, works great!!! Thanks a lot

        Comment

        Working...
        X