Determine logon and logoffs from which workstations

Any ideas how I can script determining the last workstation a user has
logged onto and logged off of? I know logins can be retrieved from AD
with userstat.exe, but this does not tell me the location of the
logons, nor if/when they logged off. I've also looked into parsing
event logs, but events 538 and 540 did not contain workstation data,
(even though there was a parameter for workstation, it was blank).
Event 528 did contain the workstations, but there are not nearly as
many 528's as there are 538. Any other ideas? Surely someone has
done this already!!!

Dan
Mon Feb 09 18:14:25 CST 2004

Create a script that grabs the username and computer name. Output this to a
file hidden server share, and name it based on username. Make 2, one for
logon and one for logoff.

I have this running and it works great. Mine actually creates it in HTML so
I can then view it through a web browser. I then have a script running on
the server hosting these log files to rename the folder at the end of the
month, and create the "current" folder. The renamed folder comes out
year-month "2004-January". Pretty damn slick for being one of my first
scripts.
See belowe for logon script. Logoff has the word logon changed to logoff ,
easy. ;)
Watch for word wrap.
----------------
'Set some variables

vari1 = "%USERNAME%"
vari2 = "%COMPUTERNAME%"
Const ForWriting = 2
Const ForAppending = 8
logloc = "\\server\share"


Set fs = CreateObject("Scripting.FileSystemObject")
Set WshShell = WScript.CreateObject("WScript.Shell")

'set variables from system environment
name = WshShell.ExpandEnvironmentStrings(vari1)
machine = WshShell.ExpandEnvironmentStrings(vari2)

'set log file location and name
aFile = logloc & name & ".htm"
Set fs = CreateObject("Scripting.FileSystemObject")

If (fs.FileExists(aFile)) Then
Set f = (fs.OpenTextFile(aFile, ForAppending))
Else
Set f = (fs.OpenTextFile(aFile, ForWriting, True))
f.WriteLine "<title>Login/Logout sheet</title>"
f.WriteLine "<h3>Login/Logout log for " & name & "</h3><br>"
f.WriteLine "<TABLE BORDER=1 HEIGHT=12 CELLPADDING=1 CELLSPACING=1>"
f.WriteLine "<TR>"
f.WriteLine "<td bgcolor=#669999><b>Event Type</b></td>" & "<td
bgcolor=#669999><b>Username</b></td>" & "<td bgcolor=#669999><b>Computer
account</b></td>" & "<td bgcolor=#669999><b>Time</b></td>" & "<td
bgcolor=#669999><b>Date</b></td></tr>"
End If
f.WriteLine "<tr>"
f.WriteLine "<td>logon</td><td>" & name & "</td><td>" & machine &
"</td><td>" & time & "</td><td>" & date & "</td>"
f.WriteLine "</tr>"
f.Close
----------------------------



"Jack" <jacksneed2000@yahoo.com> wrote in message
news:1cbee35b.0402091519.594a9901@posting.google.com...
> Any ideas how I can script determining the last workstation a user has
> logged onto and logged off of? I know logins can be retrieved from AD
> with userstat.exe, but this does not tell me the location of the
> logons, nor if/when they logged off. I've also looked into parsing
> event logs, but events 538 and 540 did not contain workstation data,
> (even though there was a parameter for workstation, it was blank).
> Event 528 did contain the workstations, but there are not nearly as
> many 528's as there are 538. Any other ideas? Surely someone has
> done this already!!!

jacksneed2000
Tue Feb 10 07:03:54 CST 2004

Thanks for the script Dan - it works great! Now, any ideas on how I
can utilize this domain wide - we have 3000+ computers, so installing
the script locally on each pc isn't feasible. Thanks for the
feedback.

Dan
Tue Feb 10 10:47:50 CST 2004

I have a windows 2000 domain, and all XP or 2000 workstations, so I use GPOs
to do push them out as logon/logoff scripts.
Otherwise, you might have to call it from within another login script you
are already using. And that is something I have never done, but I imagine it
is not too difficult.


"Jack" <jacksneed2000@yahoo.com> wrote in message
news:1cbee35b.0402100503.db27d18@posting.google.com...
> Thanks for the script Dan - it works great! Now, any ideas on how I
> can utilize this domain wide - we have 3000+ computers, so installing
> the script locally on each pc isn't feasible. Thanks for the
> feedback.

john6666
Tue Feb 10 16:10:27 CST 2004

jacksneed2000@yahoo.com (Jack) wrote in message news:<1cbee35b.0402100503.db27d18@posting.google.com>...
> Thanks for the script Dan - it works great! Now, any ideas on how I
> can utilize this domain wide - we have 3000+ computers, so installing
> the script locally on each pc isn't feasible. Thanks for the
> feedback.

I think Dan meant you should run it at logoff/logon

john6666
Wed Feb 11 16:22:52 CST 2004

See? I told you thats what he meant!

Do the GPO thing and call it from an existing logon script...

Might work with many OSs then. ;-)

"Dan King" <danking65@earthlink.net> wrote in message news:<uEgHTg$7DHA.3360@tk2msftngp13.phx.gbl>...
> I have a windows 2000 domain, and all XP or 2000 workstations, so I use GPOs
> to do push them out as logon/logoff scripts.
> Otherwise, you might have to call it from within another login script you
> are already using. And that is something I have never done, but I imagine it
> is not too difficult.
>
>
> "Jack" <jacksneed2000@yahoo.com> wrote in message
> news:1cbee35b.0402100503.db27d18@posting.google.com...
> > Thanks for the script Dan - it works great! Now, any ideas on how I
> > can utilize this domain wide - we have 3000+ computers, so installing
> > the script locally on each pc isn't feasible. Thanks for the
> > feedback.