{"id":70413,"date":"2005-02-17T09:38:00","date_gmt":"2005-02-17T09:38:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2005\/02\/17\/how-can-i-count-the-number-of-times-a-user-has-logged-on-to-a-computer\/"},"modified":"2005-02-17T09:38:00","modified_gmt":"2005-02-17T09:38:00","slug":"how-can-i-count-the-number-of-times-a-user-has-logged-on-to-a-computer","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-count-the-number-of-times-a-user-has-logged-on-to-a-computer\/","title":{"rendered":"How Can I Count the Number of Times a User has Logged on to a Computer?"},"content":{"rendered":"

\"Hey, \n

Hey, Scripting Guy! How can I count the number of times a user has logged on to a computer?

— DE<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, DE. How can you count the number of times a user has logged on to a computer? Good question and, ultimately, the answer might be: you can\u2019t. But let\u2019s at least explore some possible solutions and see if any of them will help.<\/P>\n

First of all, let\u2019s draw a distinction between logging on to a computer and logging on to a domain. If you\u2019re running Active Directory, it\u2019s possible to determine the number of times a user has logged on to the domain; that\u2019s because the user account object includes a property – LogonCount<\/B> – that keeps track of this very thing. <\/P>\n

The one catch here is that the LogonCount property is not replicated between domain controllers. Does that matter? Well, if you have only one domain controller then, no, it doesn\u2019t matter at all. If you have more<\/I> than one domain controller, however, you\u2019ll need to bind to each of these computers, retrieve the logon count, and then add those numbers together to find out how many times a user has logged on to a domain. In other words, Ken Myer might have been authenticated 5 times by domain controller A and 3 times by domain controller B. You need to add those two numbers – 5 and 3 – to determine that Ken has logged on to the domain 8 times.<\/P>\n

Incidentally, here\u2019s a script that binds to the domain controller atl-dc-01 and echoes the LogonCount value for the user Ken Myer:<\/P>

Set objUser = GetObject _\n    (“LDAP:\/\/atl-dc-01\/cn=ken myer, ou=Finance, dc=fabrikam, dc=com”)\nWscript.Echo objUser.LogonCount\n<\/PRE>\n
Again, you\u2019ll need to repeat this script for each of your domain controllers in order to get an accurate count of Ken Myer\u2019s logons.<\/P>\n
Of course, you specifically asked about counting the number of times a user has logged on to a computer. That\u2019s a bit trickier; unfortunately, the WinNT provider – which is used to manage local user accounts and Windows NT 4.0 domain accounts – doesn\u2019t support the LogonCount property. Because of that, the only way we know of to count user logons is to query the Security event log. If<\/I> you have enabled auditing for user logons, each time a user successfully logs on to a computer an event (with an event code of 528) is recorded in the Security event log. To find out how many times Ken Myer has logged on to a computer we simply need to query the Security event log for all events where the EventCode<\/B> is equal to 528 and the User<\/B> is fabrikam\\\\kmyer (and yes, both \\\u2019s are required in the query):<\/P>
strComputer = “.”\nSet objWMIService = GetObject(“winmgmts:{(Security)}\\\\” & _\n        strComputer & “\\root\\cimv2”)<\/p>\n
Set colEvents = objWMIService.ExecQuery _\n    (“SELECT * FROM Win32_NTLogEvent WHERE LogFile = ‘Security’ AND ” & _\n        “EventCode = 528 AND User = ‘fabrikam\\\\kmyer'”) <\/p>\n
Wscript.Echo colEvents.Count\n<\/PRE>\n
This will work, although there are some caveats. First of all, if you haven\u2019t enabled auditing these records won\u2019t get written to the Security event log. Second, any time you clear the event log all events are, well, cleared. As a result, all logon counts for all users will effectively get set back to 0. If you want to keep a running tally of user logons, you\u2019ll either have to never clear your event logs (not recommended) or you\u2019ll have to keep track each time you do<\/I> clear the event logs. It\u2019s not an impossible task, but it\u2019s also not as easy as it probably could be. But it\u2019s about the only option open to us.<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! How can I count the number of times a user has logged on to a computer?— DE Hey, DE. How can you count the number of times a user has logged on to a computer? Good question and, ultimately, the answer might be: you can\u2019t. But let\u2019s at least explore some possible […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,9,3,4,20,5],"class_list":["post-70413","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-adsi","tag-scripting-guy","tag-scripting-techniques","tag-user-accounts","tag-vbscript"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! How can I count the number of times a user has logged on to a computer?— DE Hey, DE. How can you count the number of times a user has logged on to a computer? Good question and, ultimately, the answer might be: you can\u2019t. But let\u2019s at least explore some possible […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/70413","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=70413"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/70413\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=70413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=70413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=70413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}