Steps to Track user logon in Windows XP/ Windows Server 2003

Tracking user is related to store information about user login, logout and other activity after login to the system. Track user login is not a feature of windows OS. So if we want to store logon information about all users, we have to write a command line script or program. This script stores user data in a secure file which has no modification access to all users except administrator.

Tracking is useful when we need some secret information about login and logout time or if we need to count time of user connectivity with the computer.

Here we store user computer name, user name, login date, time and IP address, which is sufficient for user tracking.

Step 1:
Create the following two files using Notepad or any text editor:

LOGON:
Open Text editor and write:

IPCONFIG |FIND "IP" > %temp%\filename.txt  //file in temp folder for temporary use only
FOR /F "tokens=2 delims=:" %%a in (%temp%\filename.txt) do set IP=%%a
del %temp%\filename.txt //delete temporary filename.txt
set IP=%IP:~1%  //set IP address to IP
echo Login From:, %COMPUTERNAME%, User Name:, %USERNAME%, Date:, %DATE%, Time:, %TIME%,%IP% >> \\Your Computer Name or IP Address\share$\logon.log  //print information on the file named logon.log

Save file with .cmd extention.

Edit Group Policy

LOGOFF:
Open Text editor and write:

Just change file name logoff.log instead of logon.log;
 Save file with .cmd extention.

Step 2:
After creating file, you should go to Group Policy by Start->Run->then type “gpedit.msc”. In Group Policy Tree, Traverse the tree in following order: User Configuration-> Windows Settings-> Scripts (Logon/Logoff)-> Logon, Here Click "Add" to locate your script location, then click OK.
Step 3:
Now go to "Run" from start button and type “gpupdate” to update Group Policy.

Step 4:
When users log on and off in you system, your logon file \\Your PC IP Address\SHARE$\logon.log should looks like below example:

logon Zahed User Tue 02/07/2012 10:30:51.12
logoff Johnny User Tue 02/07/2012 11:10:08.45
logon Toypet User Tue 02/07/2012 12:34:01.07
logoff Johnny User Tue 02/07/2012 12:43:46.81

I think it will work, but if have any confusion regarding this script; do not hesitate to contact with me.