Comments on: Simple User Logon Logoff Logging on a Windows Domain

By: Romanus

Romanus — Mon, 03 Sep 2007 09:31:18 +0000

Here is a same kind of thread which has more info on user logon tracking

http://msmvps.com/blogs/richardwu/archive/2007/05/29/logging-user-logon-event.aspx

By: John

John — Wed, 23 May 2007 07:12:17 +0000

Hi Mun, I suppose that in itself is another post! Keep your eyes peeled and I’ll get something put together.

There’s obviously a need for this kind of thing!

By: Mun

Mun — Tue, 22 May 2007 10:23:53 +0000

Hi,

could someone go in details on how it can be done especially when u add it the group policy etc..

Thanks

By: John

John — Thu, 19 Apr 2007 07:24:44 +0000

Glad that you got it working. It seems a little odd that it wasn’t working, even though you set the share permissions.

Anyway, if someone else has trouble it might be worth just trying to run the script from the command line to see if there is any error (such as access denied). This would probably help to find what the problem is.

By: Heather

Heather — Thu, 19 Apr 2007 00:08:25 +0000

I moved the files into the Group Policy’s logon logoff folders and it’s working.

By: Heather

Heather — Wed, 18 Apr 2007 23:40:01 +0000

Hi John, I am having the same problem as Normajm. The only thing I can think of is the folder that the file is to be written to defaults to read only in the properties (general tab), but in actual fact, anyone can write to that folder. I have given everyone full control in the securities tab and made everyone the owner of the folder as well.
I have run the mmc check above & the script has definitely been applied.
It writes for the server, but not for any other machine/login. Can you give me an idea what to try next please?
Thanks,
Heather

By: John

John — Wed, 21 Mar 2007 19:59:37 +0000

Thanks for the heads up on the "echo logoff" command. I've corrected the post re update this. As for your problem with the log not updating, two things pop into my head: 1) Are both the shared folder AND the folder permissions set to allow read/write access to users? 2) Check that the logon script is being ran with the user account that you logon with. To do this, logon to a Windows XP machine that should be using the script. Then...

Load the resultant set of policy tool by clicking 'Start', 'Run', and type mmc.
Next click 'File', 'Add/Remove Snap-in'.
Click 'Add...', select 'Resultant Set of Policy', and click 'Add', then click 'OK'.
Right-click on the 'Resultant Set of Policy' snap-in, and click 'Generate RSoP data'.
Keep clicking 'Next' until the data is generated.

You'll see a group-policy style layout showing you what settings have been applied. If the logon script has been applied successfully, then you should be able to see it in the User Configuration area of the console.

By: Normajm

Normajm — Wed, 21 Mar 2007 19:13:57 +0000

I created these two files and put them in c:/windows/sysvol/domain/scripts. Then on the DC which is SBS 2003 sp1 and added via browse to User Configuration-> Windows Settings-> Scripts (Logon/Logoff)-> Logon in the respective areas. Note, the second file I used “echo logoff” instead of “echo logon”. The log file is fully shared with domain admin and users with full permissions. Using a local workstation I can remote into the DC and get logon and logoff logs, but I don’t get any entries if I just logon and logoff the domain as a normal user from the location workstation. Any suggestions?