2

I save log in/out details of all the users to a text file through a .bat file, which is executed by Task Scheduler (on workstation-lock/unlock)/ gpedit.msc (on user logout/login).

I want to run the same or any .batfile when Switch User is chosen instead of log out/ workstation lock after CTRL+ALT+DEL. The .bat file looks like 

echo Logoff: %date% %time:~0,5% %UserName% >> c:\Logs\History.txt

Is there any way to do so?

J. Parashar
  • 123
  • 1
  • 4

1 Answers1

3

Best choice is to configure Advanced security audit policy and windows will register for you events about:

  1. User logon
  2. Workstation lock/unlock
  3. User logout

and many others that may be useful to you.

After it you will be able to analyze, collect and generally to do with these logs everything that you see fit.

If you want something to run, then you can always set up a task scheduler that runs in the registration of a certain event in the Windows event log: when configurings scheduled task trigger you has can select to start task "when a specific event is logged". Simply select Security log and 4779 eventid.

Slipeer
  • 3,295
  • 2
  • 21
  • 33
  • I agree. But I am skeptical about 'switch user' being logged. Consider a scenario : User A logs in > **A** presses CTRL+ALT+DEL> **A** chooses `switch user` and leaves the system> User **B** logs in. In this case **A**'s login time is logged and **B**'s login time is logged. But, no trace of **A** leaving the system (he never signed off). Correct me if I am missing something here. – J. Parashar Dec 28 '16 at 13:09
  • If Windows considers `switch user` to be "_Workstation Lock_" event, then the lock/unlock script should also be executed right ( which I trigger through task scheduler ) ? – J. Parashar Dec 28 '16 at 13:31
  • Sorry - misled - when user chooses `switch user` occurs event **4779** *"A session was disconnected from a Window Station."* In any case, the audit log contains all events that reflect the changes the user's session. – Slipeer Dec 28 '16 at 13:37
  • Yeah, logs are maintained. But was wondering, will I be able to run a `.bat` on `switch user`? – J. Parashar Dec 29 '16 at 06:56
  • I added in my answer the information how to set up task launch by event. – Slipeer Dec 29 '16 at 07:23