VBScript logon, logoff, startup, and shutdown scripts demonstrating how to log information to a
shared log file.
The programs log the date and time, the user name, the computer name, and the IP address
assigned to the computer. The information is appended to a log file in a shared
folder on the network.
These scripts should be specified in a Group Policy. Logon and Logoff
scripts run with the permissions of the user. The group "Domain Users" can be given
permission to write to the share that has the log file. Startup and Shutdown scripts run with
the permissions of the computer object. The group "Domain Computers" can be given write
permissions to the share where these scripts log information. Startup and Shutdown scripts can
log computer information, but not user information. The same log file can be used by all four
scripts. The programs indicate whether the entry is for "Logon", "Logoff",
"Startup", or "Shutdown" in the line that is written to the log file.
The share and log file names are hard coded in the program.
The information written by these programs to the log file is delimited by semicolons. The log file
can be imported into a spreadsheet program for analysis. For example, you could filter on computer
name to see all of the activity on one machine.
Logon5.txt <<-- Click here to view or download the logon script program
Logoff5.txt <<-- Click here to view or download the logoff script program
Startup5.txt <<-- Click here to view or download the startup script program
Shutdown5.txt <<-- Click here to view or download the shutdown script program
The VBScript program linked below parses the log file and outputs logon
sessions. The program outputs one comma delimited line per logon session
documented in the log file. The output includes the computer and user names,
logon time, logoff time, and the duration of the session. Note that sessions
are tracked by a combination of the computer and user names, to take into
account that users can be logged into more than one computer at a time.
ParseLogons.txt <<-- Click here to view or download the program
A similar program below parses the log file for computer startup and
shutdown events.
ParseStartups.txt <<-- Click here to view or download the program
Finally, the program linked below logs user and computer information to a shared log file,
just like Logon5.txt above, but it also displays the previous logon date and
computer to the user. This version does not record the IP address of the
computer. The program reads the shared log file and finds the last "Logon"
entry for the user. From this entry the program determines the last logon
time and the computer that was used. After this information is displayed to
the user, the program appends a new line to the shared log file with the
current time and the NetBIOS name of the local computer.
Logon9.txt <<-- Click here to view or download the program