Is it possible to audit logon events in such a way that the workstations
where they log on are recorded in the event log ?

"JAQK" <(E-Mail Removed)> wrote in message
news:yUJlf.8359$H84.3415@trnddc04...
> Is it possible to audit logon events in such a way that the workstations
> where they log on are recorded in the event log ?
>
>

You could use logevent.exe from the Windows Resource Kit:

logevent "%date% %time:~0,5% %UserName%"

If your number of workstations is small and you require a
central log file, you could also insert this single line into your
logon script:

echo %date% %time:~0,5% %UserName% %ComputerName% >>
\\YourServer\Logs\Logon.txt

Hi, thanks, but it's not clear at all how to use this utility and how it can
be made to
identify or display the workstation from where the domain logon was
initiated.

Any helpful suggestion would be greatly appreciated.


"Pegasus" <(E-Mail Removed)> wrote in message
news:O4A2Cj5%(E-Mail Removed)...
>
> "JAQK" <(E-Mail Removed)> wrote in message
> news:yUJlf.8359$H84.3415@trnddc04...
>> Is it possible to audit logon events in such a way that the workstations
>> where they log on are recorded in the event log ?
>>
>>
>
> You could use logevent.exe from the Windows Resource Kit:
>
> logevent "%date% %time:~0,5% %UserName%"
>
> If your number of workstations is small and you require a
> central log file, you could also insert this single line into your
> logon script:
>
> echo %date% %time:~0,5% %UserName% %ComputerName% >>
> \\YourServer\Logs\Logon.txt
>
>

Which utility? I suggested two solutions!

If it's psexec.exe then please download it, run
psexec /?, read what it says on the screen, then
post again with any questions you might have.


"JAQK" <(E-Mail Removed)> wrote in message
news:J83mf.5213$EB3.1174@trnddc09...
> Hi, thanks, but it's not clear at all how to use this utility and how it
can
> be made to
> identify or display the workstation from where the domain logon was
> initiated.
>
> Any helpful suggestion would be greatly appreciated.
>
>
> "Pegasus" <(E-Mail Removed)> wrote in message
> news:O4A2Cj5%(E-Mail Removed)...
> >
> > "JAQK" <(E-Mail Removed)> wrote in message
> > news:yUJlf.8359$H84.3415@trnddc04...
> >> Is it possible to audit logon events in such a way that the
workstations
> >> where they log on are recorded in the event log ?
> >>
> >>
> >
> > You could use logevent.exe from the Windows Resource Kit:
> >
> > logevent "%date% %time:~0,5% %UserName%"
> >
> > If your number of workstations is small and you require a
> > central log file, you could also insert this single line into your
> > logon script:
> >
> > echo %date% %time:~0,5% %UserName% %ComputerName% >>
> > \\YourServer\Logs\Logon.txt
> >
> >
>
>

We use kix32.exe with the following script as part of the domain logon
script:

$filename='\\servernamehere\wslog\'+@WKSTA+'.log'
Open(1, $filename, 5)
WriteLine(1,'@WKSTA,@USERID,@DAY,@DATE,@TIME,MAC=@ADDRESS,IP=@IPADDRESS0,@LSERVER'
+ Chr(13) + Chr(10))
Close(1)

This records who logs on to which workstation and when.

HTH

Marcus Burrows