Can I get the info from pulling log files? What is the best tool to use for this? I used to be able to do it easily with Windows 2003.

Can I get the info from pulling log files? What is the best tool to use for this? I used to be able to do it easily with Windows 2003. Hello, With help security auditing you can accomplish it.So enable security audit on your server. The below are the event IDs corresponding to user logon & logoff respectively. 4624--An account was successfully logged on. 4634--An account was logged off More security events info you can find in this Article How to enable security auditing: http://technet.microsoft.com/en-us/library/cc758201(v=ws.10).aspx Regards, Ravikumar P

That's a good start :) - what Evtx viewer do you recommend I use to format/view the data?

Can I get the info from pulling log files? What is the best tool to use for this? I used to be able to do it easily with Windows 2003. Hello, With help security auditing you can accomplish it.So enable security audit on your server. The below are the event IDs corresponding to user logon & logoff respectively. 4624--An account was successfully logged on. 4634--An account was logged off More security events info you can find in this Article How to enable security auditing: http://technet.microsoft.com/en-us/library/cc758201(v=ws.10).aspx Regards, Ravikumar P

Hi, Yes, we could view the Logon and Logoff event in Event Viewer. For details about how to check the event log, please refer to the following article. Checking event logs http://technet.microsoft.com/en-us/library/cc737766(v=ws.10).aspx In addition, we could also find users logon duration via script. For details, please refer to the article below. Find user logon duration (VBScript) http://gallery.technet.microsoft.com/scriptcenter/Find-user-logon-duration-d8b8c8e1 If you have some script related question, please ask in the script forum, we will get a better assistance there. The Official Scripting Guys Forum! http://social.technet.microsoft.com/Forums/en-US/ITCG/threads Best Regards, Andy QiAndy Qi TechNet Community Support

Hi, Yes, we could view the Logon and Logoff event in Event Viewer. For details about how to check the event log, please refer to the following article. Checking event logs http://technet.microsoft.com/en-us/library/cc737766(v=ws.10).aspx In addition, we could also find users logon duration via script. For details, please refer to the article below. Find user logon duration (VBScript) http://gallery.technet.microsoft.com/scriptcenter/Find-user-logon-duration-d8b8c8e1 If you have some script related question, please ask in the script forum, we will get a better assistance there. The Official Scripting Guys Forum! http://social.technet.microsoft.com/Forums/en-US/ITCG/threads Best Regards, Andy QiAndy Qi TechNet Community Support

See this about how to track users logon and logoff: http://support.microsoft.com/kb/556015 This can be managed by logon and logoff scripts and it will be easier than tracking events in event viewer.This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

See this about how to track users logon and logoff: http://support.microsoft.com/kb/556015 This can be managed by logon and logoff scripts and it will be easier than tracking events in event viewer.This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.