Find out who logged on to a computer

Nice scripts steve. I noticed on my computer the guest account is always getting hit when I log in. Any reason for this?

Cool addition to network administrator. Thanks for the update.

Hi guys,
I had learned many things from this site.I am System Administrator in one company and we are using Windows 2008 R2 server and XP for client pc’s.I want to monitor who had access the shared folder in server, is there any tool available to check who had access the server and who had copy the files and deleted the files in server.

So kindly help us to solve above issues.

Regards,
M.Bala

I ran both of the new additions from Network Administrator and received some strange results when I ran it against the entire domain. For example, the results showed that the company controller had logged into a lot of systems, and several other regular users logged into 3, 4, or 5 systems other than the ones they normally sit at. I am positive that this didn’t happen. In fact, we have the users lock their computers before leaving for the day. To test this, I initated an RDP session to several machines and they were still locked, under the corrrect users accounts. What I think is happening seems to be common for a lot of Windows Scripting. What I have experienced in the past is, when a script fails to return any meaningful (i.e. limited or missing)information for a system, it substitutes the values it received from the last successfully tested device. I wish this worked better but I have seen this on many networks over the years.

Hi Steve,
1. You can get the same info from the built in Event viewer\security but yes auditing needs to be turned on and your tool is a little cleaner
2. If an account was locked and then unlocked the script will consider that as a logon which is not accurate especially if I want to know the logon time, any solutions to that?

Thank you,
David

Okay, the client’s domain has 4 offices, Dallas, Houston, Amarillo and Mexico City. in Mexico City, the fired 3 people, and instead of disabling the user accoutnts, I was told to log into their systems, change their passwords, then lock the machines. This way, we could capture exactly what they were doing, and no one else could log into their machines, even the local manager (w/o rebooting).

Then, I received and installed your update, and ran both variations of the “Last Logged On” additions the very next day. It caught my attention that those specific systems showed up as being logged into by an unrelated user from the same office, not the user that I had locked the machine with (same user on all 3 systems).

Obviously, I was a little upset thinking that the person shown had rebooted the system and logged in when, by locking the PCs, no one should have been able access them.

So, I immediately initiated an RDP session, providing the administrator’s username and password but was presented with a warning on each system that the PC was logged in under the same user name that I had originally locked them uner. I saw this occur in groups across the domain. As I said in my previous post, I have seen similar utilities return the same sort of results.

My comments were just a warning that this happens sometimes so you have to do a “reality check”.

I think what you do is awesome, I appreciate everything you turn out, and wanted to point out … I was in no way trying to “steal your thunder”.

I DO get upset sometimes with the inconsistencies we find in such things. I truly believe Microsoft does some wonderful things, but then, when you need them to do something simple like returning accurate results on important items such as this, they just “let it go”. These bugs will stay with them forever and they won’t fix them, which is why a lot of these “goodies” go unnoticed. You know, the 5 minutes of time/work needed by a single programmer to make these tools work could improve millions of lives, if only in a small way, and it would certainly help to reduce the frustrations they cause by leaving “broken” toys lying around for people to trip over.

Enough of that. I programmed in a dissimilar programming environment (Pick Operating System and its variants) for over 20 years. Even though I no longer do programming, per se, I still have a ton of insight into how things should, could or would work, and how they may or may not be used.

I take care of a couple hundred systems on a regular basis, so I have the access needed to test things out for you. I would be happy to report back “the good” and “the bad” that I run into.

Just a thought …

Steve