logging users & time

  • Thread starter Thread starter 12NV
  • Start date Start date
1

12NV

I have multiple users set up on XP home; I would like to create a log file
that captures the users time of log in/out. And there password for logging
on to the PC..

I know this can be done on NT; creating a batch file with lastpwd command

Any help would be appreciated
Thank you
 
Isn't this already logged by the system and viewed/managed in the Event
viewer?

Hope this is useful to you. Let us know.

rms
 
I am unfamiliar with this program; or where to find it.. I am running on XP
home edition...
Not sure this machine has such a program. NT does..

thank you for your help
greatly appreciated;
 
I found it in system32 file; there is 2: 1.)is called EVENT VIEWER SNAPIN
LAUNCHER 2.)Microsoft Common Console Document..
which do you run?


"Rob Schneider"
 
XP is NT so do the same thing. Lastpwd does not do logging. Nor does it records passwords. Plus it only works on domains (though this particular function used by lastpwd only work on NT Workstation (or 2000/XP pro and presumbly XP home) or NT4 server or earlier. Though you can use it as a sample to do the local machine (use locals.exe rather than global.exe).

Get nltest.exe (the program that lastpwd uses to extract user info - it gets the user names from global.exe but non domains can use local.exe - both NOT on the XP CD, but if you know the names you don't need them and user names are listed in several places) from the Support Tools on the CD, type

nltest /server:<name of non domain server that has the account> /user"my user name"

EG My XP Pro is called serenity. My username is david candy
nltest /server:serenity /user:"David Candy"

And this is what it says.

User: David Candy
Rid: 0x3eb
Version: 0x10002
LastLogon: 11073574 01c41423 = 3/28/2004 3:43:51
PasswordLastSet: 8480106e 01c38235 = 9/24/2003 10:48:06
AccountExpires: ffffffff 7fffffff = 5/11/650 1176:14:41
PrimaryGroupId: 0x201
UserAccountControl: 0x210
CountryCode: 0x0
CodePage: 0x0
BadPasswordCount: 0x0
LogonCount: 0xdf
AdminCount: 0x1
SecurityDescriptor: 80140001 0000009c 000000ac 00000014 00000044 00300002 000000
02 0014c002 01050044 00000101 01000000 00000000 0014c002 000f07ff 00000101 05000
000 00000007 00580002 00000003 00240000 00020044 00000501 05000000 00000015 52da
be9d 4d08e33d 320a1743 000003eb 00180000 000f07ff 00000201 05000000 00000020 000
00220 00140000 0002035b 00000101 01000000 00000000 00000201 05000000 00000020 00
000220 00000201 05000000 00000020 00000220
AccountName: David Candy
Groups: 00000201 00000007
LmOwfPassword: fb820c9c 5c7e7e09 6ef61eb0 9d9ca845
NtOwfPassword: 6067dfc6 bf58f89d 3fa0f7f2 c8693d5e
NtPasswordHistory: 00010001
LmPasswordHistory: 00010001
The command completed successfully

Note no password. Windows is designed to stop anyone learning anyone else's passwords. It's how admins stay accountable.

You need to explain further as your behaviour is that of a criminal. Only criminals look for this sort of info.
 
Back
Top