List of users who used a computer - KiXtart.org

You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Basic Scripting » List of users who used a computer

Page 1 of 1

Topic Options

#121333 - 2004-06-16 01:10 PM List of users who used a computer
horhe horhe Fresh Scripter Registered: 2004-06-16 Posts: 10	Hi there once more, Is there any method to extract a list of a number (maybe 10) of users who used specified computer in Active Directory (server win2k3, clients winxp), thanks for any help. Horhe.
Top

#121334 - 2004-06-16 01:13 PM Re: List of users who used a computer
Breaker Breaker Hey THIS is FUN Registered: 2001-06-15 Posts: 268 Loc: Yorkshire, England	Simple way to do this would be to enumerate the profiles under c:\documents and settings... throw away the default user, all users, administrator, etc and there's your list. No timestamp to this, though. _________________________ ================================================ Breaker
Top

#121335 - 2004-06-16 01:19 PM Re: List of users who used a computer
horhe horhe Fresh Scripter Registered: 2004-06-16 Posts: 10	But if I'd like to get also dates of last login? Check the time of last modifications done to profiles ? And will it work if I run it on a server? Documents ... aren't shared in the network, woludn't it be a problem?
Top

#121336 - 2004-06-16 01:50 PM Re: List of users who used a computer
Breaker Breaker Hey THIS is FUN Registered: 2001-06-15 Posts: 268 Loc: Yorkshire, England	Can't really test this as I'm out of the office this week, but I'm sure someone will correct me if I'm wrong... I would have thought that you could read the last modified time of the ntuser.dat file to get that info. _________________________ ================================================ Breaker
Top

#121337 - 2004-06-16 02:32 PM Re: List of users who used a computer
Radimus Radimus Moderator Registered: 2000-01-06 Posts: 5187 Loc: Tampa, FL	you can read the local machine security log for: event: 538 where User is not ANONYMOUS LOGON or SYSTEM _________________________ How to ask questions the smart way <-----------> Before you ask
Top

#121338 - 2004-06-16 02:47 PM Re: List of users who used a computer
horhe horhe Fresh Scripter Registered: 2004-06-16 Posts: 10	So if there isnt any way to get this info from workstation, could you direct me somewhere to find out about getting info from logs?
Top

#121339 - 2004-06-16 03:03 PM Re: List of users who used a computer
Kdyer Kdyer KiX Supporter Registered: 2001-01-03 Posts: 6241 Loc: Tigard, OR	You should be able to get to this info by using a WMI Query or DUMPEL (from the Resource Kit) and then parsing the resulting data. Kent _________________________ Utilize these resources: UDFs (Full List) KiXtart FAQ & How to's
Top

#121340 - 2004-06-16 03:07 PM Re: List of users who used a computer
horhe horhe Fresh Scripter Registered: 2004-06-16 Posts: 10	ok, thx, going testing
Top

#121341 - 2004-06-16 04:55 PM Re: List of users who used a computer
horhe horhe Fresh Scripter Registered: 2004-06-16 Posts: 10	Ok, i know how to get out info from even remote workstation (thanks for your help ) dumpel -s \\workstation -l security -m security -e 528 > out.txt But could you tell me how to filter out only dates and names, because this produces sth like that: 6/16/2004 16:30:25 8 2 528 Security SERVER\d129651 STATION1 Successful Logon: User Name: d129651.
Top

#121342 - 2004-06-16 05:05 PM Re: List of users who used a computer
Radimus Radimus Moderator Registered: 2000-01-06 Posts: 5187 Loc: Tampa, FL	use readfile() to read it use filterArray() to filter out 'ANONYMOUS LOGON' use filterArray() to filter out 'system' $seclog=readfile('c:\out.txt') $seclog=filterarray($seclog,'User Name:',1) ;include all lines with 'User Name:' $seclog=filterarray($seclog,'ANONYMOUS LOGON') ;exclude all lines with 'ANONYMOUS LOGON' $seclog=filterarray($seclog,'System') ;exclude all lines with 'System' for each $line in $seclog ? $line ? trim(split($line,'User Name:')[1]) next _________________________ How to ask questions the smart way <-----------> Before you ask
Top

#121343 - 2004-06-16 05:05 PM

Re: List of users who used a computer

Richard H. Offline

Administrator

Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK

Something like this will do:

Code:

$sFile="out.txt"
$fdFile=FreeFileHandle()

If Open($fdFile,$sFile)
   "Cannot open file "+$sFile+" for reading!" ?
   @ERROR ": " @SERROR ?
Else
   $sLine=ReadLine($fdFile)
   While Not @ERROR
	$aData=Split($sLine)

	"Date:	"+$aData[0]+@CRLF
	"Time:	"+$aData[1]+@CRLF
	"Logon:	"+$aData[12]+@CRLF

   	$sLine=ReadLine($fdFile)
   Loop
EndIf

Top

#121344 - 2004-06-16 05:07 PM Re: List of users who used a computer
horhe horhe Fresh Scripter Registered: 2004-06-16 Posts: 10	Little update: i missed formatting options, after adding ...-format udt -c... i get a list DOMAIN\user,,date,time. Is there any way to sort it by date because it's in the reversed order? Not from some date to now, but from now to some date and removing fields other than domain\... (because there are also services listed).
Top

#121345 - 2004-06-16 05:08 PM Re: List of users who used a computer
horhe horhe Fresh Scripter Registered: 2004-06-16 Posts: 10	Wow thanks for really fast reply Going testing BIG thx.
Top

#121346 - 2004-06-16 05:09 PM Re: List of users who used a computer
Kdyer Kdyer KiX Supporter Registered: 2001-01-03 Posts: 6241 Loc: Tigard, OR	A combination or READLINE with INSTR should do it.. That is READ the line in.. Test for the 528 event code and then you could dump these into a separate file.. Kent _________________________ Utilize these resources: UDFs (Full List) KiXtart FAQ & How to's
Top

#121347 - 2004-06-16 05:11 PM Re: List of users who used a computer
Richard H. Richard H. Administrator Registered: 2000-01-24 Posts: 4946 Loc: Leatherhead, Surrey, UK	You need to read in the file, then write it out to a new file in the order: Code: YYYY/MM/DD HH:MM:SS Login You can now sort the file using DOS sort. The natural order will sort correctly.
Top

#121348 - 2004-06-16 05:21 PM

Re: List of users who used a computer

Richard H. Offline

Administrator

Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK

Here is a version with a sort built-in:
Code:

$sFile="out.txt"
$sExtract="extract.txt"
 
$fdFile=FreeFileHandle()
 
If Open($fdFile,$sFile)
   "Cannot open file "+$sFile+" for reading!" ?
   @ERROR ": " @SERROR ?
Else
   $=RedirectOutput($sExtract)
   $sLine=ReadLine($fdFile)
   While Not @ERROR
	$aData=Split($sLine)
	$aData[0]=Split($aData[0],"/")

	$aData[0][2]+"/"+Right("0"+$aData[0][0],2)+"/"+Right("0"+$aData[0][1],2)
		+" "+$aData[1]
		+" "+$aData[UBound($aData)]
		+@CRLF

   	$sLine=ReadLine($fdFile)
   Loop
   $=RedirectOutput("")
   SHELL '%COMSPEC% /C SORT "'+$sExtract+'"'
EndIf

Top

#121349 - 2004-06-16 05:35 PM Re: List of users who used a computer
horhe horhe Fresh Scripter Registered: 2004-06-16 Posts: 10	Hm, when I run that version with sorting in the extract.txt I get error ERROR : array reference out of bounds! My out.txt has format like this: DOMAIN\admin,,6/16/2004,16:15:18 What's wrong?
Top

#121350 - 2004-06-16 07:08 PM Re: List of users who used a computer
Richard H. Richard H. Administrator Registered: 2000-01-24 Posts: 4946 Loc: Leatherhead, Surrey, UK	It's because the code is for the original version out the output. You will need to change the delimiter for split from " "->"," and change the array subscript references to match your "out" file. ...or feed in the data in the original format.
Top

#121351 - 2004-06-17 09:23 AM Re: List of users who used a computer
horhe horhe Fresh Scripter Registered: 2004-06-16 Posts: 10	Ok, i'm very thankfull to all of you. Thanks one more time.
Top

Page 1 of 1

Previous Topic View All Topics

Index Next Topic

Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart

Hop to:

Shout Box

Search the board with:
superb Board Search
or try with google:

	Web kixtart.org