Active Directory Users logon and logoff report - Solved

For Active directory user’s logon and logoff reports, it needs the third party tools. But in windows have that capability. Most of the IT professionals are not learned DOS commands in-depth. The DOS command does this process. All are heard about echo command; this command can do the report for our need.

For Example:-

Go to your command prompt, type the below following command.

Echo %username% is logged on to %computername% at %time% 

The above command gives the output like his name, computer name and login time. Our need is to generate report for all users, so here we need to create a logon batch file script. Before creating the batch file, we need to create a central repository for storing the log files. Create a hidden share for logon, logoff and give the permission to users.Batch file for logon script Copy the below code edit the systemname, sharename and paste into the notepad, then save it as batch (.bat) file.

Echo %username% is logged on to %computername% at %time% >> \\systemname\Sharename$\%username%_logon.csv

The batch file needs to put on the logon script in the group policy. All log files will be save in separate for each users. Please find the below image, that was the output.

 

For Log off report use the below command for batch file

Echo %username% is logged on to %computername% at %time% >> \\systemname\Sharename$\%username%_logoff.csv

Copy the above code and create a batch file, apply on the logoff script in the group policy.

Shutdown Event Tracker Group Policy

We can enable / disable shutdown event tracker for servers and workstation. In server family operating system enabled by default. In workstation disabled by default. Through this policy we can enable and disable on both family.

Open your defined group policy from the console.

Navigate --> Computer Configuration --> Administrative Templates-->System --> Click the Display shutdown event tracker from the right side of the pane. 

 

Double click the  Display shutdown event tracker.

 

Click Enabled for enabling the shutdown event tracker. From the drop down menu we can choose either workstation / server or always. Always option for both server and workstation.

Disable remote desktop by using group policy

We can Disable remote desktop (Terminal services) through group policy.

1. Open your group policy editor for your defined OU or Site.

Navigate to computer configuration then expand Administrative templates , then windows components and then click Terminal Services.

 

Then Double Click the Allow users to connect remotely using terminal services policy from the right side pane.

 

Then Click apply and ok. Refresh your policy settings.. Now it will disable on all clients

Disable Command Prompt Group Policy

We can disable the command prompt through group policy.

Please follow the below instructions.

1.     Open your group policy editor for your defined OU.

2.      Click the User configuration à Administrative Templates à System

3. Double click the " Prevent access to the command prompt " from the left side, see the above picture.

4. Then click the enable radio button.

5.  Then Click OK , Refresh your group policy settings.

Registry Editing has been disabled by your administrator - Trick

Registry Editing has been disabled by your administrator, if you get this error message. The registry editor has been disabled by your system admin through group policy.


We can remove the restriction through a command in standalone machine.


1. Go to Command Prompt. Type the below command 
2. REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v 
DisableRegistryTools /t REG_DWORD /d 0 /f


 Now you able to acces to your local machine registry editor.

What is an access control list (ACL)?

The Microsoft Windows 2000 Active Directory glossary defines an access control list as “a set of data associated with a file, directory, or other resource that defines the permissions that users and/or groups have for accessing it. In the Active Directory™ service, an ACL is a list of access control entries (ACEs) stored with the object it protects. In the Windows NT® operating system, an ACL is stored as a binary value, called a security descriptor.”

What is an access control entry (ACE) ?

The Microsoft Windows 2000 Active Directory glossary states that “each ACE contains a security identifier (SID), which identifies the principal (user or group) to whom the ACE applies, and information on what type of access the ACE grants or denies.”