Kaseya Community

Record of Logged on User

  • Does the Kaseya agent keep a record of users logons on agents?

    Thanks.

  • I whipped this vbscript up quickly and only did a little testing, so it may not be perfect, but you'll get the idea:

     

    Set myobjWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!" & strComputer & "\root\cimv2")
    Set mycolEvents = myobjWMI.ExecQuery("Select * from Win32_NTLogEvent Where Logfile = 'Security'")

    For Each myobjEvent in mycolEvents
    If myobjEvent.EventCode = "4648" Then
    If InStr(myobjEvent.Message, "dan") > 0 AND InStr(myobjEvent.Message, "winlogon.exe") > 0 Then
    wscript.echo "----" & myobjEvent.TimeGenerated & " dan logged in"
    End If
    End If

    If myobjEvent.EventCode = "4634" Then
    If InStr(myobjEvent.Message, "dan") > 0  Then
    wscript.echo "----" & myobjEvent.TimeGenerated & " dan logged out"
    End If
    End If

    Next