VBScript logon, logoff, startup, and shutdown scripts demonstrating how to log information to a shared log file. The programs log the date and time, the user name, the computer name, and the IP address assigned to the computer. The information is appended to a log file in a shared folder on the network.

These scripts should be specified in a Group Policy. Logon and Logoff scripts run with the permissions of the user. The group "Domain Users" can be given permission to write to the share that has the log file. Startup and Shutdown scripts run with the permissions of the computer object. The group "Domain Computers" can be given write permissions to the share where these scripts log information. Startup and Shutdown scripts can log computer information, but not user information. The same log file can be used by all four scripts. The programs indicate whether the entry is for "Logon", "Logoff", "Startup", or "Shutdown" in the line that is written to the log file. The share and log file names are hard coded in the program.

The information written by these programs to the log file is delimited by semicolons. The log file can be imported into a spreadsheet program for analysis. For example, you could filter on computer name to see all of the activity on one machine.

Logon5.txt <<-- Click here to view or download the logon script program

Logoff5.txt <<-- Click here to view or download the logoff script program

Startup5.txt <<-- Click here to view or download the startup script program

Shutdown5.txt <<-- Click here to view or download the shutdown script program

The VBScript program linked below parses the log file and outputs logon sessions. The program outputs one comma delimited line per logon session documented in the log file. The output includes the computer and user names, logon time, logoff time, and the duration of the session. Note that sessions are tracked by a combination of the computer and user names, to take into account that users can be logged into more than one computer at a time.

ParseLogons.txt <<-- Click here to view or download the program

A similar program below parses the log file for computer startup and shutdown events.

ParseStartups.txt <<-- Click here to view or download the program