{"id":4246,"date":"2024-10-07T11:49:27","date_gmt":"2024-10-07T11:49:27","guid":{"rendered":"https:\/\/www.systools.in\/blog\/?p=4246"},"modified":"2024-12-02T12:52:07","modified_gmt":"2024-12-02T12:52:07","slug":"active-directory-user-login-report","status":"publish","type":"post","link":"https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/","title":{"rendered":"Active Directory User Login Report with or without PowerShell"},"content":{"rendered":"<p>Admins who need an Active Directory user login report often rely on PowerShell scripts. However, that&#8217;s not the only way to get that data. Multiple methods like command line, ADUC, etc which we discuss through this write-up.<\/p>\n<div class=\"alert alert-info\">\n<p><strong>Table of Contents<\/strong><\/p>\n<ul>\n<li><strong><a href=\"#powershell-report\">AD User Logon Report with PowerShell<\/a><\/strong><\/li>\n<li><strong><a href=\"#command-line\">Command Line Query Method<\/a><\/strong><\/li>\n<li><strong><a href=\"#event-viewer\">Event Viewer Check<\/a><\/strong><\/li>\n<li><strong><a href=\"#traditional\">Traditional Tracking Method<\/a><\/strong><\/li>\n<li><strong><a href=\"#professional\">Professional Monitoring Solution<\/a><\/strong><\/li>\n<li><strong><a href=\"#script-free\">Script-Free AD Login Report Guide<\/a><\/strong><\/li>\n<li><strong><a href=\"#conclusion\">Conclusion<\/a><\/strong><\/li>\n<li><strong><a href=\"#faq\">FAQ<\/a><\/strong><\/li>\n<\/ul>\n<\/div>\n<p>This will allow admins to choose the best possible approach for revealing the entry-exit timeline of various users on the Active Directory. As PowerShell is the most in-demand method let&#8217;s start from there.<\/p>\n<h2 id=\"powershell-report\">Make an Active Directory User Logon Logoff Report with PowerShell<\/h2>\n<p>Here is a basic query that uses the last login parameters on a particular domain controller.<\/p>\n<pre>Get-ADUser -Filter * -Property lastLogoff, lastLogon | Select-Object Name,\r\n@{Name='LastLogoff'; Expression={\r\n$date = [DateTime]::FromFileTime($_.lastLogoff)\r\nif ($date -eq [DateTime]::FromFileTime(0)) { \"Never\" } else { $date }\r\n}},\r\n@{Name='LastLogon'; Expression={\r\n$date = [DateTime]::FromFileTime($_.lastLogon)\r\nif ($date -eq [DateTime]::FromFileTime(0)) { \"Never\" } else { $date }\r\n}}\r\n<\/pre>\n<p>This script calls the lastLogoff, and lastLogon parameters and converts them into the corresponding date-time value. The never string indicates that either the user has not logged in or not logged out.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-4250\" src=\"https:\/\/www.systools.in\/blog\/wp-content\/uploads\/2024\/08\/ad-user-login-pwrshl-code.webp\" alt=\"PowerShell to Make Active Directory User Login Report \" width=\"735\" height=\"660\" \/><\/p>\n<p>After admins <a href=\"https:\/\/www.systools.in\/blog\/bulk-add-users-to-active-directory\/\" target=\"_blank\" rel=\"noopener\">add users to the active directory in bulk<\/a> they often have to monitor the login activity to see if those accounts are being used or not.<\/p>\n<p>For that, you can count and track every login and log out individually. So for that admins have to add an Active Directory user login report export mechanism from their end.<\/p>\n<pre># Import the Active Directory module\r\nImport-Module ActiveDirectory\r\n# Function to get AD user login\/logout history for the last 24 hours\r\nfunction Get-UserLoginLogoutHistory {\r\n \u00a0\u00a0\u00a0param(\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[string] $UserName,\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[switch] $LogonTypeLocal,\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0[switch] $LogonTypeRemote\r\n \u00a0\u00a0\u00a0)\r\n \u00a0\u00a0\u00a0$startDate = (Get-Date).AddDays(-1)\r\n \u00a0\u00a0\u00a0$endDate = Get-Date\r\n \u00a0\u00a0\u00a0# Get security events for login success and logouts for the last 24 hours\r\n \u00a0\u00a0\u00a0$filterXPath = \"*[System[((EventID=4624) or (EventID=4634)) and TimeCreated[@SystemTime&gt;='{0}' and @SystemTime&lt;='{1}']]]\" -f $startDate.ToUniversalTime().ToString(\"s\"), $endDate.ToUniversalTime().ToString(\"s\")\r\n \u00a0\u00a0\u00a0$events = Get-WinEvent -LogName Security -FilterXPath $filterXPath -ErrorAction SilentlyContinue\r\n \u00a0\u00a0\u00a0# Filter events based on username and logon type\r\n \u00a0\u00a0\u00a0if ($UserName) {\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$events = $events | Where-Object { $_.Properties[5].Value -eq $UserName }\r\n \u00a0\u00a0\u00a0}\r\n \u00a0\u00a0\u00a0$loginEvents = @{}\r\n \u00a0\u00a0\u00a0$logoutEvents = @{}\r\n \u00a0\u00a0 foreach ($event in $events) {\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$samAccountName = $event.Properties[5].Value\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$sessionId = $event.Properties[7].Value\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$logonType = $event.Properties[8].Value\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# Skip if not matching LogonType filters\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if (($LogonTypeLocal -and $logonType -eq 3) -or ($LogonTypeRemote -and $logonType -ne 3)) {\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0continue\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if ($event.Id -eq 4624) {\u00a0 # Login event\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$loginEvents[\"$samAccountName-$sessionId\"] = $event\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} elseif ($event.Id -eq 4634) {\u00a0 # Logout event\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$logoutEvents[\"$samAccountName-$sessionId\"] = $event\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}\r\n \u00a0\u00a0 }\r\n \u00a0\u00a0\u00a0# Process login events and match with logout events\r\n \u00a0\u00a0\u00a0foreach ($key in $loginEvents.Keys) {\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$loginEvent = $loginEvents[$key]\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$logoutEvent = $logoutEvents[$key]\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$samAccountName = $loginEvent.Properties[5].Value\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$computer = $loginEvent.Properties[11].Value\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$logonType = if ($loginEvent.Properties[8].Value -eq 3) { \"Remote\" } else { \"Local\" }\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# Get full name to construct active directory user login report\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try {\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$adUser = Get-ADUser -Identity $samAccountName -Properties DisplayName -ErrorAction Stop\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$fullName = $adUser.DisplayName\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0catch {\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$fullName = \"Unable to retrieve full name\"\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$userLogin = [PSCustomObject]@{\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"UserName\" = $samAccountName\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"FullName\" = $fullName\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"Computer\" = $computer\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"LogonType\" = $logonType\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"LoginTime\" = $loginEvent.TimeCreated\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"LogoutTime\" = if ($logoutEvent) { $logoutEvent.TimeCreated } else { \"Session still active or logout not recorded\" }\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"SessionDuration\" = if ($logoutEvent) {\u00a0\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$duration = $logoutEvent.TimeCreated - $loginEvent.TimeCreated\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"{0:D2}:{1:D2}:{2:D2}\" -f $duration.Hours, $duration.Minutes, $duration.Seconds\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0} else { \"N\/A\" }\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Write-Output $userLogin\r\n \u00a0\u00a0\u00a0}\r\n}\r\n# Call the Get-UserLoginLogoutHistory function with default parameters\r\nGet-UserLoginLogoutHistory -UserName \"\" -LogonTypeLocal:$false -LogonTypeRemote:$false<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-4249\" src=\"https:\/\/www.systools.in\/blog\/wp-content\/uploads\/2024\/08\/ad-user-login-pwrshl.webp\" alt=\"PowerShell Script\" width=\"823\" height=\"622\" \/><\/p>\n<p>This PowerShell script retrieves user login and logout history from Windows Security Event logs for the past 24 hours. It filters events by username and logon type (local or remote), matches login and logout events, and outputs detailed information including username, full name, computer, logon type, login\/logout times, and session duration.<\/p>\n<p>However, beware depending on the number of events the script may stuck or take a long time to execute. If PowerShell feels tight there are other code-based methods that can serve as the alternatives.<\/p>\n<h2 id=\"command-line\">Use Command Line Query and Get Active Directory User login Report<\/h2>\n<p>Open the command line and type<\/p>\n<pre>query user \/SERVER:servername<\/pre>\n<p>Replace \u201cservername\u201d with the one where you are tracking the user activity. However, keep in mind this query can only be used if your workstation is on the same network as the target AD.<\/p>\n<p>If due to regulatory pressure or personal reasons admin <a href=\"https:\/\/www.systools.in\/blog\/rename-ad-user-with-powershell\/\">renames an\u00a0 AD user using PowerShell<\/a> there is always a chance that the user struggles with login errors. To make sure that this does not happen in your case formulate a checklist beforehand.<\/p>\n<p>Here is an alternative bat script that makes use of the net command at the domain level to get the list of all users<\/p>\n<pre>@echo off\r\nsetlocal enabledelayedexpansion\r\necho Username,Last Logon\r\nfor \/f \"skip=5 tokens=1,* delims= \" %%a in ('net user \/domain') do (\r\n \u00a0\u00a0\u00a0set \"user=%%a\"\r\n \u00a0\u00a0\u00a0if not \"!user!\"==\"The\" if not \"!user!\"==\"command\" (\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0for \/f \"tokens=1,* delims=:\" %%i in ('net user !user! \/domain ^| findstr \/C:\"Last logon\"') do (\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0set \"lastlogon=%%j\"\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if \"!lastlogon!\"==\"\" set \"lastlogon= Never\"\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0echo !user!,!lastlogon!\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0)\r\n \u00a0\u00a0\u00a0)\r\n)\r\npause<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-4248\" src=\"https:\/\/www.systools.in\/blog\/wp-content\/uploads\/2024\/08\/ad-user-login-cmd-bat.webp\" alt=\"BAT script\" width=\"835\" height=\"531\" \/><br \/>\nThis script limits its scope to the current machine so any login activity from outside is not reported here.<\/p>\n<h3 id=\"event-viewer\">Check the Event Viewer to See the User Logon Logoff Time in AD<\/h3>\n<p>The Event Viewer is a default addition in all Windows machines so most likely you have it preinstalled on your system as well.<\/p>\n<p>Not all user login attempts are genuine in nature so if admins identify any suspicious activity it might be a smart call to preemptively <a href=\"https:\/\/www.systools.in\/blog\/reset-user-password-in-active-directory\/\" target=\"_blank\" rel=\"noopener\">reset the user password in Active Directory<\/a> at once.<\/p>\n<p>This program keeps a log of all activity that occurs in the AD so every user login and log-out details can be seen from there.<\/p>\n<p>Open Event Viewer &gt; Windows Logs &gt; Security<\/p>\n<p>Search for the following IDs:<\/p>\n<ul>\n<li>4624 \u2013 Successful account logon:<\/li>\n<li>4625 \u2013 Failed account logon:<\/li>\n<li>4634 \u2013 Account logoff:<\/li>\n<li>4647 \u2013 User-initiated logoff:<\/li>\n<li>4648 \u2013 User Logon With Explicit Credentials:<\/li>\n<\/ul>\n<p>In case the Event Viewer fails to display\/contain the data<\/p>\n<p>Then either you have selected the wrong domain controller, or the Event Viewer is yet to receive the GPO access to record the events.<\/p>\n<p>In the case of the latter, the Event Viewer starts recording from that moment onwards so any previous login event won&#8217;t be visible.<\/p>\n<p>If you do not want to look at every login logout but just the last one then the AD contains some inbuilt solution. So let&#8217;s see how to use it.<\/p>\n<h3 id=\"traditional\">Traditional Way to Track User Entry-Exit in Active Directory<\/h3>\n<p>Your Active Directory comes with a whole host of tools and add-ons to monitor the resources. These can also be used to keep an eye on the total duration of the user activity inside AD. Use these steps to display a preliminary Active Directory User Login Report.<\/p>\n<ul>\n<li><strong>Open<\/strong> the <strong>ADUC<\/strong> snap-in.<\/li>\n<li>Click on <strong>View<\/strong> and enable the <strong>Advanced Features<\/strong>.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-4251\" src=\"https:\/\/www.systools.in\/blog\/wp-content\/uploads\/2024\/08\/aduc-1.webp\" alt=\"ADUC View\" width=\"752\" height=\"530\" \/><\/li>\n<li>Find the <strong>User in OU<\/strong> whose login you want to know.<\/li>\n<li><strong>Right Click<\/strong> &gt; Select <strong>Properties<\/strong>.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-4252\" src=\"https:\/\/www.systools.in\/blog\/wp-content\/uploads\/2024\/08\/aduc-2.webp\" alt=\"User Properties\" width=\"755\" height=\"530\" \/><\/li>\n<li>Toggle the <strong>Attribute Editor<\/strong> tab &gt; Type \u201c<strong>log<\/strong>\u201d<\/li>\n<li>The <strong>Logon, Logoff, and Time Stamp<\/strong> all should be visible.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-4247\" src=\"https:\/\/www.systools.in\/blog\/wp-content\/uploads\/2024\/08\/aduc-3.webp\" alt=\"Preliminary Active Directory User Login Report in ADUC\" width=\"411\" height=\"557\" \/><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Unfortunately, this is where the Active Directory log user logon logoff with ADUC ends. So you are stuck with a strictly view-only setup. Moreover, if you try to edit the parameter to copy it instead of the date\/time you get a large inter value instead. Which is not at all useful for reporting purposes.<\/p>\n<p>Combining this limitation with the time-consuming and repetitive nature of the operation it becomes quite clear why admins abandon this method from the get-go. Not to worry as we have an alternative that combines the ease.<\/p>\n<h3 id=\"professional\">Professionally Monitor When Logs-in and Logs-out of the Server<\/h3>\n<p>To make an Active Directory user login report use <strong>SysTools AD Reporting software<\/strong>. With a GUI-based domain setup and password-protected login mechanism, admins can track the Entry-Exit timings of all users remotely.<\/p>\n<p>Apart from the basic tracking, this piece of software has a smart feature to list down all users that never logged in post account creation. So admins can use this report to delete or disable all such dormant accounts at once.<\/p>\n<p class=\"text-center mr-2\" style=\"text-align: center;\"><a class=\"btn btn-lg btn-md-block text-white\" style=\"background: #28a745; color: #ffffff !important; cursor: text;\" href=\"https:\/\/systoolskart.com\/download\/SYS4A2D6R\/29\" rel=\"nofollow\"> Download Now<\/a> <a class=\"btn btn-lg btn-md-block text-white\" style=\"background: #ff6800; color: #ffffff !important; cursor: text;\" href=\"https:\/\/systoolskart.com\/buy\/SYS4A2D6R\/29\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Purchase Now<\/a><\/p>\n<p>Moreover, not only can this tool <a href=\"https:\/\/www.systools.in\/blog\/export-ad-user-list-to-csv-format\/\">export Active Directory users to CSV<\/a> format but also provides a glimpse at the data using its unique preview mechanism. Admins can set a custom duration or pick a pre-set time interval from 5, 7, 10, 30, 60, 90 (days), or up to a year at most. The following set of steps reveals how easy it is to operate the tool in your local environment.<\/p>\n<h3 id=\"script-free\">Get a Script Free Active Directory User Login Report Step-By-Step<\/h3>\n<p>Step 1. Use the appropriate workstation to <strong>load and launch the tool<\/strong>. Let the administrator credentials fill in on their own then <strong>hit the Login button<\/strong>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone\" src=\"https:\/\/systoolskart.com\/imgp\/ad-reporter\/step-1.webp\" alt=\"Type administrator to start Active Directory last login report\" width=\"900\" height=\"482\" \/><\/p>\n<p>Step 2. With your cursor <strong>press the REGISTER DOMIN CONTROLLER<\/strong> icon to open the domain registry popup.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone\" src=\"https:\/\/systoolskart.com\/imgp\/ad-reporter\/step-6.webp\" alt=\"Press Register Domain Controller button to add the AD DC where you want to log user logon logoff\" width=\"900\" height=\"482\" \/><\/p>\n<p>Step 3. Enter the <strong>Domain-friendly name<\/strong> and the corresponding <strong>IP address for your AD<\/strong>, then hit the Save and Continue button.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone\" src=\"https:\/\/systoolskart.com\/imgp\/ad-reporter\/step-8.webp\" alt=\"Save and Continue\" width=\"900\" height=\"482\" \/><\/p>\n<p>Step 4. The tool takes you to the <strong>Domain Details page<\/strong> where you need to <strong>complete admin credential validation<\/strong>. After that <strong>toggle the Reports<\/strong> tab.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone\" src=\"https:\/\/systoolskart.com\/imgp\/ad-reporter\/step-10.webp\" alt=\"Toggle Reports to track user logins in Active Directory\" width=\"900\" height=\"482\" \/><\/p>\n<p>Step 5. Under the <strong>Users Workload<\/strong> Select the <strong>\u201cLogin\u201d category<\/strong>.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/systoolskart.com\/imgp\/ad-reporter\/step-12.webp\" alt=\"User\" \/><\/p>\n<p>Step 6. Use the <strong>duration picker<\/strong> to select the timeline from which you want to make the <strong>Active Directory last login report<\/strong>.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/systoolskart.com\/imgp\/ad-reporter\/step-12-6.webp\" alt=\"preset time intervals\" \/><\/p>\n<p>Step 7. Click on the <strong>Preview button<\/strong>, and take a look at the <strong>user list before the export<\/strong>.<\/p>\n<p>Step 8. Expand the <strong>Download Report option<\/strong> and select <strong>CSV<\/strong>.<\/p>\n<p>Step 9. <strong>Save the file<\/strong> in the intended location and open it using any spreadsheet viewer.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone\" src=\"https:\/\/systoolskart.com\/imgp\/ad-reporter\/step-22.webp\" alt=\"successful download message for Active Directory last login report\" width=\"900\" height=\"482\" \/><\/p>\n<h4 id=\"conclusion\">Conclusion<\/h4>\n<p>All those admins who want an Active Directory user login report can now do so in any of the five different ways that we covered here. While the Active Directory user logon logoff report PowerShell scripts and .bat files give a code-style review option, those with a non-technical background can rely on ADUC or event viewer.<\/p>\n<p>However, every manual approach has one limitation or the other, with lack of remote access being the common drawback in every single one. Therefore, to bypass this admins can rely on the automated alternative that gives them a user logon and logoff time report easily.<\/p>\n<h4 id=\"faq\">Frequently Asked Questions on Active Directory User Login Reports?<\/h4>\n<p><strong>Can I get User Login Logoff Information via the Active Directory Administrative Center?<\/strong><br \/>\nYes, if you are an administrator or someone with equivalent access, you can track user login logout activity from the ADAC as well.<br \/>\nFor that, launch the portal &gt; use the Global Search to find the correct user.<\/p>\n<p><strong>Is it possible to see from where a User login attempt is being made in AD?<\/strong><br \/>\nYou can identify the computer on which the user is trying to log in. However, regarding the physical location, Active Directory does not have the capability to geolocate login attempts.<\/p>\n<p><strong>How many Active Directory login logout events can be registered in the Event Viewer?<\/strong><br \/>\nIf you are seeing an unusually high amount of login attempts, especially at odd hours, it does not always mean a hacking attempt. It has been a known issue that when users have their phones connected to the Exchange server and have had their password changed, the phone keeps a cached copy of old credentials, which it uses to connect to the server continuously.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Admins who need an Active Directory user login report often rely on PowerShell scripts. However, that&#8217;s not the only way to get that data. Multiple methods like command line, ADUC, <\/p>\n","protected":false},"author":7,"featured_media":4253,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[361],"class_list":["post-4246","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-active-directory"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Active Directory User Login Report with or without PowerShell<\/title>\n<meta name=\"description\" content=\"Learn to make an Active Directory user login report in multiple manners to track every user-level logon\/logoff with PowerShell and more.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"siddharth\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/active-directory-user-login-report\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/active-directory-user-login-report\\\/\"},\"author\":{\"name\":\"siddharth\",\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/#\\\/schema\\\/person\\\/a719240fe0eff759b37c012b65b0f138\"},\"headline\":\"Active Directory User Login Report with or without PowerShell\",\"datePublished\":\"2024-10-07T11:49:27+00:00\",\"dateModified\":\"2024-12-02T12:52:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/active-directory-user-login-report\\\/\"},\"wordCount\":1457,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/active-directory-user-login-report\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/active-directory-user-login-report.webp\",\"articleSection\":[\"Active Directory\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.systools.in\\\/blog\\\/active-directory-user-login-report\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/active-directory-user-login-report\\\/\",\"url\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/active-directory-user-login-report\\\/\",\"name\":\"Active Directory User Login Report with or without PowerShell\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/active-directory-user-login-report\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/active-directory-user-login-report\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/active-directory-user-login-report.webp\",\"datePublished\":\"2024-10-07T11:49:27+00:00\",\"dateModified\":\"2024-12-02T12:52:07+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/#\\\/schema\\\/person\\\/a719240fe0eff759b37c012b65b0f138\"},\"description\":\"Learn to make an Active Directory user login report in multiple manners to track every user-level logon\\\/logoff with PowerShell and more.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/active-directory-user-login-report\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.systools.in\\\/blog\\\/active-directory-user-login-report\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/active-directory-user-login-report\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/active-directory-user-login-report.webp\",\"contentUrl\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/active-directory-user-login-report.webp\",\"width\":636,\"height\":357,\"caption\":\"Active Directory User Login Report with or without PowerShell\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/active-directory-user-login-report\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Active Directory User Login Report with or without PowerShell\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/\",\"name\":\"Informative Blogs Related To Technologies &amp; Data Recovery Solutions\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/#\\\/schema\\\/person\\\/a719240fe0eff759b37c012b65b0f138\",\"name\":\"siddharth\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/36008fc382c078c0181bbc3f19fd908ee42a71cf3d336b9b2864d3ba99da3786?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/36008fc382c078c0181bbc3f19fd908ee42a71cf3d336b9b2864d3ba99da3786?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/36008fc382c078c0181bbc3f19fd908ee42a71cf3d336b9b2864d3ba99da3786?s=96&d=mm&r=g\",\"caption\":\"siddharth\"},\"description\":\"With years experience in Data Recovery field, I am well aware of the technicalities faced by the user while working on various technologies and applications. I love to sharing technical data through my blogs and articles regarding the technology.\",\"url\":\"https:\\\/\\\/www.systools.in\\\/blog\\\/author\\\/siddharth\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Active Directory User Login Report with or without PowerShell","description":"Learn to make an Active Directory user login report in multiple manners to track every user-level logon\/logoff with PowerShell and more.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/","twitter_misc":{"Written by":"siddharth","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/#article","isPartOf":{"@id":"https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/"},"author":{"name":"siddharth","@id":"https:\/\/www.systools.in\/blog\/#\/schema\/person\/a719240fe0eff759b37c012b65b0f138"},"headline":"Active Directory User Login Report with or without PowerShell","datePublished":"2024-10-07T11:49:27+00:00","dateModified":"2024-12-02T12:52:07+00:00","mainEntityOfPage":{"@id":"https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/"},"wordCount":1457,"commentCount":0,"image":{"@id":"https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/#primaryimage"},"thumbnailUrl":"https:\/\/www.systools.in\/blog\/wp-content\/uploads\/2024\/08\/active-directory-user-login-report.webp","articleSection":["Active Directory"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/","url":"https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/","name":"Active Directory User Login Report with or without PowerShell","isPartOf":{"@id":"https:\/\/www.systools.in\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/#primaryimage"},"image":{"@id":"https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/#primaryimage"},"thumbnailUrl":"https:\/\/www.systools.in\/blog\/wp-content\/uploads\/2024\/08\/active-directory-user-login-report.webp","datePublished":"2024-10-07T11:49:27+00:00","dateModified":"2024-12-02T12:52:07+00:00","author":{"@id":"https:\/\/www.systools.in\/blog\/#\/schema\/person\/a719240fe0eff759b37c012b65b0f138"},"description":"Learn to make an Active Directory user login report in multiple manners to track every user-level logon\/logoff with PowerShell and more.","breadcrumb":{"@id":"https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/#primaryimage","url":"https:\/\/www.systools.in\/blog\/wp-content\/uploads\/2024\/08\/active-directory-user-login-report.webp","contentUrl":"https:\/\/www.systools.in\/blog\/wp-content\/uploads\/2024\/08\/active-directory-user-login-report.webp","width":636,"height":357,"caption":"Active Directory User Login Report with or without PowerShell"},{"@type":"BreadcrumbList","@id":"https:\/\/www.systools.in\/blog\/active-directory-user-login-report\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.systools.in\/blog\/"},{"@type":"ListItem","position":2,"name":"Active Directory User Login Report with or without PowerShell"}]},{"@type":"WebSite","@id":"https:\/\/www.systools.in\/blog\/#website","url":"https:\/\/www.systools.in\/blog\/","name":"Informative Blogs Related To Technologies &amp; Data Recovery Solutions","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.systools.in\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.systools.in\/blog\/#\/schema\/person\/a719240fe0eff759b37c012b65b0f138","name":"siddharth","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/36008fc382c078c0181bbc3f19fd908ee42a71cf3d336b9b2864d3ba99da3786?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/36008fc382c078c0181bbc3f19fd908ee42a71cf3d336b9b2864d3ba99da3786?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/36008fc382c078c0181bbc3f19fd908ee42a71cf3d336b9b2864d3ba99da3786?s=96&d=mm&r=g","caption":"siddharth"},"description":"With years experience in Data Recovery field, I am well aware of the technicalities faced by the user while working on various technologies and applications. I love to sharing technical data through my blogs and articles regarding the technology.","url":"https:\/\/www.systools.in\/blog\/author\/siddharth\/"}]}},"_links":{"self":[{"href":"https:\/\/www.systools.in\/blog\/wp-json\/wp\/v2\/posts\/4246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.systools.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.systools.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.systools.in\/blog\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/www.systools.in\/blog\/wp-json\/wp\/v2\/comments?post=4246"}],"version-history":[{"count":0,"href":"https:\/\/www.systools.in\/blog\/wp-json\/wp\/v2\/posts\/4246\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.systools.in\/blog\/wp-json\/wp\/v2\/media\/4253"}],"wp:attachment":[{"href":"https:\/\/www.systools.in\/blog\/wp-json\/wp\/v2\/media?parent=4246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.systools.in\/blog\/wp-json\/wp\/v2\/categories?post=4246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}