Hi, I'm trying to build a report that will let me view when a user last logged off a machine. we're trying to meter a lab to determine if we should adjust out lab hours

I can build a report with the report wizard, but am unable to find a logoff time to check against
also being able to use it per label would be great.

please help, or point me in the right direction if someone would be so kind

thanks
0 Comments   [ + ] Show Comments

Comments

Please log in to comment

Rating comments in this legacy AppDeploy message board thread won't reorder them,
so that the conversation will remain readable.

Answers

0
This is what i did to get the info.

First i started with a powershell script i found on the internet.

$UserProperty = @{n="User";e={(New-Object System.Security.Principal.SecurityIdentifier $_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])}}
$TypeProperty = @{n="Action";e={if($_.EventID -eq 7001) {"Logon"} else {"Logoff"}}}
$TimeProeprty = @{n="Time";e={$_.TimeGenerated}}
Get-EventLog System -Source Microsoft-Windows-Winlogon | select $UserProperty,$TypeProperty,$TimeProeprty

I save that as "get logon logoff.ps1".

Next i configured a shell script to run on my machines.

Upload the ps1 script, then add this for script text.
@echo off
if not exist c:\windows\tvg mkdir c:\windows\tvg\
powershell.exe -nologo -executionpolicy bypass -WindowStyle hidden -noprofile -file "get logon logoff.ps1" > c:\windows\tvg\userLogs.txt

What that does is create a text file on each computer with the logon info.

Next we create a custom inventory rule to pull the logon info called "LogOn / LogOff'
Here's the syntax for the command:
ShellCommandTextReturn(cmd.exe /c type c:\windows\tvg\userLogs.txt).

Here's the SQL to the report.
SELECT M.NAME,
MCI.STR_FIELD_VALUE
FROM SOFTWARE S,
MACHINE_CUSTOM_INVENTORY MCI,
MACHINE M
WHERE MCI.SOFTWARE_ID = S.ID
AND M.ID = MCI.ID
AND S.DISPLAY_NAME = 'LogOn / LogOff'

It looks a lil funny because of the formatting from the file.

If anyone has ideas on how to clean it up, i'd love to hear em!
Answered 02/10/2012 by: dchristian
Red Belt

Please log in to comment
Answer this question or Comment on this question for clarity