Department of Energy Argonne National Laboratory Office of Science NEWTON's Homepage NEWTON's Homepage
NEWTON, Ask A Scientist!
NEWTON Home Page NEWTON Teachers Visit Our Archives Ask A Question How To Ask A Question Question of the Week Our Expert Scientists Volunteer at NEWTON! Frequently Asked Questions Referencing NEWTON About NEWTON About Ask A Scientist Education At Argonne Capturing NT4 Login/out
Name: Chuck W.
Status: Educator
Age: 50s
Location: N/A
Country: N/A
Date: 2002

CHow can one capture the login and logout time of a user's NT 4.0 session. I realize that user.dat in the ..\profiles\ directory will reflect the logout time. I am wondering if there are some registry entries that reflect both. And if a user never logs off the NT 4.0 system, how would one capture any new activity on the keyboard? For instance identifying any activity after a 2 hour idle period.

Chuck, that is a great question!

To answer your question in regards to track when a user logs into an NT computer as well as logging out, you can set up Auditing. When you enable auditing, you can track when the user logs in and out, this is displayed in the form of a security audit in the security log of the domain controller if no domain controller is present the audit will appear in the local security log of the computer. If a user never logs off the machine and you would like to capture any keystrokes, you can install a software package called Boss Everywhere, this software package contains a client and server application. The client piece of the software will capture any keystrokes on the computer and then send them to a server where they can be reviewed for your inspection you can also set up special alarms so when an action takes place or if you computer is idle for any given time, you can cause an event to occur. I hope this helps!

Best Regards

Joe Noga
MCSE, MCSA, CCNA Certified
Windows 2000 Active Directory Specialist

Click here to return to the Computer Science Archives

NEWTON is an electronic community for Science, Math, and Computer Science K-12 Educators, sponsored and operated by Argonne National Laboratory's Educational Programs, Andrew Skipor, Ph.D., Head of Educational Programs.

For assistance with NEWTON contact a System Operator (, or at Argonne's Educational Programs

Educational Programs
Building 360
9700 S. Cass Ave.
Argonne, Illinois
60439-4845, USA
Update: June 2012
Weclome To Newton

Argonne National Laboratory