user logged in within 24 hours

Home Forums Scripting Windows Script Host user logged in within 24 hours

Viewing 1 post (of 1 total)
  • Author
  • Avatar

    Hello everyone!

    This script is to show User that Logged in to a machine/ server within 24 Hours or more

    This VBscript was first written by Remco Simmon. It does work for me and I don’t know why it
    is not sending the output to a text file.

    I used

    cmd /c cscript.exe /nologo “userlogged.vbs” >>output.txt

    to call the path in CMD prompt per Techamel.

    Before I ran the codes I tried to use Wscript.Echo it didn’t work for maybe I used it wrongly. Some of my problems was
    that I always get the same time for all the users on that local computer. It is almost like it is a made up time just to show something:
    It has no relationship with the date enumerated.

    The second was that I am not able to use this code on remote computers. To this end I ask, “What code needs to be written to
    make it work remotely?”I have attached the snap shots of my solution. I don’t know how to fix this timing
    issue any help will be highly appreciated.

    ****Another thing I will like to do will be to change MsgBox to Wscript.Echo so that I can easily get an out put in a .txt file.********


    ‘ [thread]55222[/thread]

    Option explicit

    ‘ List Last logins on a client
    ‘ By Remco Simons [NL] 2011
    ‘ (Note !,
    ‘ also a remote WMI session to the computer and other
    ‘ types of remote logon can be Registered User Logins too! )

    Const HKEY_LOCAL_MACHINE = &H80000002
    Dim strComputer, oReg, oWMISvc, regEx, dt
    Dim strFile, arrComputers

    strComputer = “.” ‘for local computer enter “.

    strFile = “List Logons over the last 24 hours.txt”
    Set oReg=GetObject(“winmgmts:{impersonationLevel=impersonate}!\” & _
    strComputer & “rootdefault:StdRegProv”)
    Set oWMISvc = GetObject(“winmgmts:rootcimv2”)
    Set regEx = New RegExp
    dt = now

    call LastLogons(getLocalBIAS)
    Sub LastLogons(lngBias)
    Dim strKeyPath, arrSubKeys, subkey, strValueName
    Dim sUsr, LastLogon, TimeHigh, TimeLow

    On Error Resume Next
    regEx.Pattern = “^S-1-5-21-[0-9]*-[0-9]*-[0-9]*-[0-9]*$”
    regEx.IgnoreCase = TRUE

    strKeyPath = “SOFTWAREMicrosoftWindows NTCurrentVersionProfileList”
    oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys

    For Each subkey In arrSubKeys
    If regEx.Test(subkey)=TRUE Then
    sUsr = resolveSID(subkey)

    strValueName = “ProfileLoadTimeHigh”
    oReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath _
    & “” & subkey, strValueName,TimeHigh

    strValueName = “ProfileLoadTimeLow”
    oReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath _
    & “” & subkey, strValueName,TimeLow

    LastLogon = getDT(TimeHigh, TimeLow, lngBias)

    If sUsr = Empty Then
    strValueName = “ProfileImagePath”
    oReg.GetExpandedStringValue HKEY_LOCAL_MACHINE, strKeyPath _
    & “” & subkey, strValueName,sUsr
    End If

    ‘ last 24 hours only,
    rem If DateDiff(“n”,LastLogon, dt)/60 =< 24 Then ' one particular user only, rem If InStr(1,sUsr,"m112559",1) Then MsgBox sUsr & vbNewline _ & "LastLogon: " & LastLogon, _ ,"Computer: " & strComputer 'Wscript.Echo "LastLogon:" & LastLogon_ ',"Computer: " & strComputer rem End If rem End If End If Next End Sub Function getLocalBIAS ' Obtain local Time Zone bias from machine registry. ' (= the time-zone + daylight saving offset) ' This bias changes with Daylight Savings Time. Dim strKeyPath, strValueName, lngBiasKey strKeyPath = "SystemCurrentControlSetControlTimeZoneInformation" strValueName = "ActiveTimeBias" oReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValueName,lngBiasKey If (UCase(TypeName(lngBiasKey)) = "LONG") Then getLocalBIAS = lngBiasKey ElseIf (UCase(TypeName(lngBiasKey)) = "VARIANT()") Then getLocalBIAS = -0 For k = 0 To UBound(lngBiasKey) getLocalBIAS = getLocalBIAS + (lngBiasKey(k) * 256^k) Next End If End Function Function getDT(H, L, Bias) On Error Resume Next Dim HexVal, Highpart, Lowpart, lngDate 'HexVal = H 'HexVal = Replace(HexVal, "0x", "") 'HexVal = Replace(HexVal, "&H", "") 'Highpart = CLng("&H" & HexVal) Highpart = H ' 'HexVal = L 'HexVal = Replace(HexVal, "0x", "") 'HexVal = Replace(HexVal, "&H", "") 'Lowpart = CLng("&H" & HexVal) Lowpart = L '# unite the HighPart and LowPart lngDate = Highpart * 2^32 + L '# convert the number of 100-Nanosecond intervals to days lngDate = ((lngDate*1E-7/60) -Bias)/1440 'days '# Add the number of days to the "zero" date getDT = CDate( #11/15/2012# + lngDate ) End Function Function resolveSID(sid) Dim strUser, strDomain On Error Resume Next With oWMISvc With .Get("Win32_SID.SID='" & sid & "'") strUser = .AccountName strDomain = .ReferencedDomainName End With End With If len(strUser) = 0 Then resolveSID = Empty Else resolveSID = strDomain & "" & strUser End If End function

Viewing 1 post (of 1 total)

You must be logged in to reply to this topic.