Access logs in Excel format

Obtain an Exce-readable, comma-delimited security logon/logoff/lockout log file (.csv) of a server.

Todd Plesco

Published: 19 Feb 2002

This tip was submitted to the SearchWin2000.com Tip Exchange by member Todd Plesco. Let other users know how useful it is by rating the tip below.

Obtain an Excel-readable, comma-delimited security logon/logoff/lockout log file (.csv) of a server in your domain. Using the Resource Kit's dumpel.exe utility, you can create a file called stats.csv, then optionally convert the three digit access codes using FR.EXE (i.e. File Search/Replace Version 1.4 by Tony Provalov, built Dec. 16, 1999) to decipher the three digits to text of logon/logoff/badpasswords.

From command line, type:

{pdcservername}c$winntsystem32dumpel -f stats.csv 
     -s {servername} -l security -d 1 -format uIdt -c

From the command line, then run this code as a batch file:

@echo off
fr stats.csv "528" "console user logon    " stats1.csv
fr stats1.csv "538" "console user logoff   " stats.csv
fr stats.csv "540" "network user logon    " stats1.csv
fr stats1.csv "673" "service ticket granted" stats.csv
fr stats.csv "681" "network logon FAILURE " stats1.csv
fr stats1.csv "539" "account LOCKED OUT    " stats.csv
fr stats.csv "529" "BAD PASSWORD to log in" stats1.csv
fr stats1.csv "680" "account used to log in" stats.csv

Dig Deeper on Enterprise software

Users are unique, and their VDI user profiles should be too You're a unique individual, so shouldn't your VDI user profile be special too? Learn how IT can provide user personalization for virtual desktops.

Using AuditPol to audit Windows users and set policies Solution providers may find value in the AuditPol utility for auditing and organizing Windows users, setting policies and configuring settings such as user privileges.

Windows 7 audit object access categories, user permissions Solution providers can configure Windows 7 audit object access and user logon and logoff settings to achieve optimal security levels in their customer's environment.

Logon Scripts - Terminal Services for Windows Server 2003 Logon scripts in Terminal Server environments are no different from those in any other type of environment - they are simply batch files that run whenever a user logs on to the server.

NDS Integration with Feature Release 1 or 2 - Citrix MetaFrame XP Citrix begins to address the problem of integrating MetaFrame XP environments with NetWare environments

Logon and Logoff Scripts - Citrix MetaFrame XP Logon scripts in MetaFrame XP environments are no different than in any other type of environment-they are just than batch files that run whenever a user logs on to the server.

SearchVirtualDesktop

Join the conversation

3 comments

Send me notifications when other members comment.

Oldest

[-]

AnonymousUser - 25 Sep 2013 8:19 PM

Great security script. Thank you.

agareev - 2 Nov 2015 6:41 PM

That's a very nice example of creativity. Good old command line tools sometimes still beat fancy UI's!

ToddN2000 - 3 Nov 2015 1:00 PM

Nice. How often we forget the command line tools.

Access logs in Excel format