Announcement

Collapse
No announcement yet.

Logon time

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • caspi
    started a topic Logon time

    Logon time

    Hi all,

    Pleasw I would like to get information about some users in active directory 2003. Sometimes I need to know time when specific user logon to the domain. I can be many days ago. Event log is not good. Does anybody know some usable utility or anything else where I can specify USER and DATE? output should be exact time when user logged in...

    Thanks

  • wullieb1
    replied
    Re: Logon time

    I scripted mine

    Code:
    Option Explicit
    
    Dim objRootDSE, objDomain, objmemberOf, objGroup, objUser
    Dim objFSO, objShell, lngBiasKey, lngBias
    Dim strUser, strDN, strList, strLDAP
    Dim objRootLDAP, objLastLogon
    Dim intLastLogonTime
    
    Set objFSO = WScript.CreateObject("Scripting.FileSystemObject")
    Set objShell = CreateObject("WScript.Shell")
    Set objRootDSE = GetObject("LDAP://RootDSE")
    Set objDomain = GetObject("LDAP://" & objRootDSE.Get("DefaultNamingContext"))
    
    strUser = inputbox("Please enter the users display name.", "Last Logon Time for a Specific User")
    
    Do while strUser = ""
    	msgbox "You MUST enter a username.", "ERROR"
    	strUser = inputbox("Please enter the users display name.", "Last Logon Time for a Specific User")
    Loop
    
    getDN objDomain
    
    Set objUser = GetObject("LDAP://" & strDN)
    Set objLastLogon = objUser.Get("lastLogon")
    
    TimeZone
    
    intLastLogonTime = objLastLogon.HighPart * (2^32) + objLastLogon.LowPart 
    intLastLogonTime = ((intLastLogonTime / 600000000) - lngBias)
    intLastLogonTime = intLastLogonTime / 1440
    
    MsgBox "Last logon time: " & intLastLogonTime + #1/1/1601#
    
    Sub getDN(objCont)
    	Dim objUser
    	For Each objUser in objCont
    		Select Case LCase(objUser.Class)
    			Case "user"
    				If (UCase(objUser.cn) = UCase(strUser)) then
    					strDN = objUser.distinguishedName
    				End If
    			case "organizationalunit", "container"
    		getDN objUser
    		End Select
    	Next
    End Sub
    
    Sub TimeZone	
    	' Obtain local Time Zone bias from machine registry.
    	Set objShell = CreateObject("Wscript.Shell")
    	lngBiasKey = objShell.RegRead("HKLM\System\CurrentControlSet\Control\" & "TimeZoneInformation\ActiveTimeBias")
    	If (UCase(TypeName(lngBiasKey)) = "LONG") Then
    	    lngBias = lngBiasKey
    	ElseIf (UCase(TypeName(lngBiasKey)) = "VARIANT()") Then
        	lngBias = 0
        	For k = 0 To UBound(lngBiasKey)
            	lngBias = lngBias + (lngBiasKey(k) * 256^k)
        	Next
    	End If
    End Sub

    Leave a comment:


  • DYasny
    replied
    Re: Logon time

    http://technet2.microsoft.com/Window...a079d1033.mspx
    http://msdn.microsoft.com/en-us/library/ms190260.aspx
    http://www.microsoft.com/technet/sec.../tcgch03n.mspx

    google it
    ________
    Accidental death and dismemberment insurance advice
    Last edited by DYasny; 6th March 2011, 18:43.

    Leave a comment:

Working...
X