This page looks best with JavaScript enabled

Quick PoSH: User Logon Auditing

 ·  ☕ 1 min read

Here’s a quick and dirty user logon/logoff auditing script that has been helpful in educational institutions. The script is available to download from GitHub.

Usage

Open the Group Policy Object at the top most level of your domain(s) and add the script to the PowerShell scripts area. On log on, add the -logon parameter, and on log off add the -logoff parameter. Create a hidden share somewhere on your network, and give ‘Authenticated Users’ Full Control share and file permissions. Edit the $LogFile variable at the top of the script to the full path of the hidden share, including the name of the log file you wish to create. The log file includes the computer name, domain name, user name, and time and date of the log on or log off event. They are separated by commas should you wish to manipulate the data in Excel.

If you’d like to get in touch with me please use the comments, Twitter (you can tweet me and my DMs are open) or my contact form. Please consider donating to support my work:

Thank you!

-Mike

Share on
Support the author with