Kaseya Community

User login/logout logging and reporting

This question has suggested answer(s)

Hi All,

We have a requirement to generate reports on user login/logout times for certain Windows machines.

The idea we had was to set up user audit logging so entries are created in the event log of the computers in question, then run some kind of parser daily or weekly to generate a basic report of the login/logout times for certain staff members.

I have set up Monitors on event logs before and had a look at Log File Parsers but we are just getting to grips with Kaseya so after looking at the options it became clear asking on the forum might be a good place to start.

Has anyone done something similiar  that they could provide examples of?  Of perhaps offer some guidance.

Thanks 

All Replies
  • Its very easy

    1. Create a new report

    2. Go to monitoring and select Up time History

    3. Select how many days to go back, I generally use the last 7 and report on a Friday.

    Now when you run the report you should get a graph with the exact times the person logged off and on, and when the machine was powered down etc.

  • Thanks Zach, that works very well.

    We have a Server 2008 Terminal Server and the uptime reports do not show individual users.  Any idea on how to have those use login times reported?

  • Also just to note on this if Kausrtsk.exe is not running this will not show any users - thats why it won't work for a TS as it only shows one user on a TS and generally this is only users logged into the console session or the first user that logs in.

  • I believe there is a way of getting Kausrtsk.exe to run on terminal sessions, but I'm not sure how that would work for this purpose and I haven't tried getting it to run in terminal sessions myself.

  • How to create the Terminal Services Session directory.  You could then parse this data to display in Kaseya?  Just a thought.

    I was able to find this KB article http://support.microsoft.com/kb/327508

    The Terminal Services Session directory log file contains the following entries:

    • Session Directory service started
    • Session Directory service stopped
    • Machine joins session directory
    • Machine leaves session directory
    • User logs in
    • User disconnects
    • User reconnects
    • User logs out
    • Session Directory-related event log messages.

  • intresting idea, did you turn this on on your W2008 RD Server? what does the log actually look like?

  • cool, keen to see if anyone makes something from this.

  • I will be testing this tonight on a 2k3 server and 2k8 server

  • I found that the KB article does not mention that this service is only available to enterprise level 2003 and 2008 servers.

    The service is automatically installed on 2003 Terminal servers and can be accessed with no problem.  2008 users will need to install Terminal Services Session directory in the server manager.

    I do not have access to any TS running on enterprise and was not able to complete the testing.  Has anyone else looked into this possibility?