User Login and Log out Information

Question:

How can I get a user's login and logout time?

Answer:

There is no way to get a logoff time.

In the simplest terms, a user may authenticate to their user account multiple times from different workstations or in different Terminal Server or Citrix sessions on different servers. In fact, every single time that the user's credentials need to be authenticated due to the LogonUser() Win32 API function being called, the logon time gets updated on the particular domain controller [either primary or a backup] that satisfies the logon request. This means that obtaining logon time information requires communicating with every single domain controller in the domain and asking each one for the last logon time information for the user in question.

Logoff times are not tracked as the user processes that are created using an access token that was obtained by calling LogonUser() don't make any calls back to the domain controller to report a logoff event. Instead, what you normally have to do, is have an "agent" - a custom-written program - be launched in the user's session at logon time, and when the user ends their session, have this agent report the logoff event and store it for future use. It's your choice as to whether you send it to a central server to make reporting easy to do, or if you store it locally on the workstation and require all workstations to batch-upload this information at timed intervals to a central server.

Article ID:   W17068

File Created: 2007:07:03:14:28:04

Last Updated: 2007:07:03:14:28:04

Database Search

TechHome