How to Get User Logon Session Times from the Event Log


To figure out user session time, you’ll first need to enable three advanced audit policies; Audit Logoff, Audit Logon and Audit Other Logon/Logoff Events.

The combination of these three policies get you all of the typical logon/logoff events but also gets the workstation lock/unlock events and even RDP connect/disconnects. This ensures we get all of the session start/stop events.

When these policies are enabled in a GPO and applied to a set of computers, a few different event IDs will begin to be generated.  They are:

  • Logon – 4624 (Security event log)
  • Logoff – 4647 (Security event log)
  • Startup – 6005 (System event log)
  • RDP Session Reconnect – 4778 (Security event log)
  • RDP Session Disconnect – 4779 (Security event log)
  • Locked – 4800 (Security event log)
  • Unlocked – 4801 (Security event log)

You’ll notice the startup event. Why that one? The reason is because what if the computer’s power plug is pulled while a user is logged in? How will we know when that is. It’s not a perfect metric but it’s the only date/time we have to show when that happened.

Once we’ve got all of the IDs put together, we’ll then need to match the session start event with the very next session end event. But what if there are multiple users logging into a computer? To differentiate we can use the Logon ID field.  This is a unique field for each logon session. If we can find a session start time and then look up through the event log for the next session stop time with the same Logon ID we’ve found that user’s total session time.

In this instance, you can see that the LAB\Administrator account had logged in (ID 4624) on 8/27/2015 at 5:28PM with a Logon ID of 0x146FF6. I then looked up through the event log at the subsequent messages until I found a session end event (ID 4634) that showed up with the same Logon ID at 5:30PM on the same day. Knowing this Logon ID, I was then able to deduce that the LAB\Administrator account had been logged on for three minutes or so.

This was just a quick demonstration of actual logon/logoff scenarios. You’ll find that when you review a computer in the “real world” you can’t always depend on logon/logoff events if you’d like to find user session durations. Multiple scenarios may come into play such as when a user locks her computer and comes back to unlock it. Perhaps she may lock her computer and the power gets cut. There will be no unlock event; only a startup event. These are the gotchas you need to watch out for to be able to accurately calculate user session history.

参考博文:

Logon Session Times的更多相关文章

  1. IIS导入.pfx证书时报错:"A specified logon session does not exist. It may already have been terminated."

    在IIS中可以直接导入.pfx文件来给站点绑定https协议: 如果在导入.pfx文件时,不选择"Allow this certificate to be exported"的话 ...

  2. C#穿透session隔离———Windows服务启动UI交互程序

    在Windows服务里面启动其他具有界面的应用程序,需要穿透session隔离,尝试了很多种方法,都可行,现在一一列举下来,并写下几个需要注意的地方. 需要注意的地方 首先要将服务的Account属性 ...

  3. Audit logon events&Logon type

    表一.Logon type 表二.Audit logon events 表三.Logon type details Logon type Logon title Description 2 Inter ...

  4. System Error Codes

    很明显,以下的文字来自微软MSDN 链接http://msdn.microsoft.com/en-us/library/windows/desktop/ms681382(v=vs.85).aspx M ...

  5. 浅析Windows安全相关的一些概念

    Session 我们平常所说的Session是指一次终端登录, 这里的终端登录是指要有自己的显示器和鼠标键盘等, 它包括本地登录和远程登录.在XP时代每次终端登录才会创建一个Session,但是在Vi ...

  6. Windows Directory ACL Security Check By ACL Baseline

    catalog . Windows NTFS ACL(MAC) Permission . How the System Uses ACLs . 服务器不安全ACL配置带来的攻击向量 . NTFS AC ...

  7. IE下Debug BHO

    主要就是修改注册表键值使IE不创建多个进程:HKLM\Software\Microsoft\Internet Explorer\Main - TabProcGrowth 但需要注意的是这种情况下,vs ...

  8. windows命令行及批处理文件小结

    1.命令Shell概述(Command shell overview): The command shell is a separate software program that provides ...

  9. Windows 错误代码

    Error Messages for Windows http://www.gregorybraun.com/MSWINERR.ZIP Server 4.0 Error Messages   Code ...

随机推荐

  1. c语言中有bool型变量吗?

    C语言里面是没有bool(布尔)类型的,C++里面才有,这就是说,在C++里面使用bool类型是没有问题的. bool类型有只有两个值:true =1 .false=0. 但是,C99标准里面,又定义 ...

  2. IIS8.5设置 MVC HTTP 错误 404.0 - Not Found

    0. 确认 设置IIS的“ISAPI和CGI限制”中的“ASP.NET v4.0.0.30319”为允许 1. 解决方案 <system.webServer>    <modules ...

  3. SQL 查询结果为 XML

    --原始数据 SELECT  OrderNO,CreateDate,Username,Address FROM   Whir_Order_OrderInfo --1.AUTO模式 SELECT  Or ...

  4. Unity3D刚体不同力的测试(ForceMode,AddForce,RelativeAddForce)

    摘自圣典的一段翻译: ForceAdd a continuous force to the rigidbody, using its mass.添加一个可持续力到刚体,使用它的质量.Accelerat ...

  5. PyCharm Python迁移项目

    把整个项目文件迁移过去后,执行文件会报不能执行XX,系统找不到指定的文件. 此时把当前的这个文件名字改一下,再运行,修改提示的错误.等错误全部修改,可以正常运行后,再把文件名改回去

  6. 0057 Spring MVC如何获取HTTP请求头信息--URL中的动态参数--@RequestHeader--@CookieValue--@PathVariable

    获取HTTP请求头信息 一个HTTP请求除了有参数和实体内容外还有HTTP请求头信息,Spring MVC也可以获取这部分信息 @RequestHeader解可以将请求头信息映射到处理方法的形参上 @ ...

  7. 关于 web中 使用 java.net.URLEncoder.encode 要编码两次呢 , js的encodeURIComponent 同理

    因为在jsp中对中文进行了编码的时候用的是UTF-8的编码方式,而在servlet中调用request.getParameter();方法的时候使用服务器指定的原始编码格式(ISO-8859-1)自动 ...

  8. Elasticsearch分析聚合

    原文链接:http://blog.csdn.net/napoay/article/details/53484730

  9. 安装第三方模块时遇到Python version 2.7 required, which was not found

    ## script to register Python 2.0 or later for use with win32all# and other extensions that require P ...

  10. 使用BestSync同步软件与坚果云同步

    坚果云的免费用户可以享受每个月的1G上传与3G下载流量,同时号称是国内唯一支持WebDAV的云.我的工作备份的文档不多,正好手头有BestSync同步软件可以用.决定试试BestSync的与WebDA ...