Windows Logon Hours Exception Report

[RSAAdmin]

Hello,

 

Is it possible to generate a report of users logging into windows workstations outside of normal business hours?  What we are looking is some type of reporting of users logging in using their AD credentials outside of:

Mon. – Fri. 7am- 8pm

Saturday 7am – 3pm  

Any suggestions would be appreciated

[RSAAdmin]

You can filter the Daily Logons/Logoffs report located under  Hosts>>>Windows within the Ad Hoc Report tab to meet your time range.

Alternately, if you are using Group Policy to enforce login time restrictions the Windows Failed Logons report will capture all attempted logon activity that fails as a result of the time restriction being enforced.

-Scott

[RSAAdmin]

Another idea for you would be to use one of the time based DATEFORMAT in your select statement. For example select DATEFORMAT(WindowDeviceStamp, 'hh:mm')  in your select statement and include something like this in your Where clause

AND  (DATEFORMAT(WindowDeviceStamp, 'hh:mm') <= '05:00' OR DATEFORMAT(WindowDeviceStamp, 'hh:mm') >= '17:00'). Adjust your times as necessary. Then you would generate a report for any time period and it would only include Events that occured before 5 am or after 5pm in this example.

[RSAAdmin]

Schedule one Windows Login report to run on Monday at exactly 7 AM spanning the Previous 32 hours (that will cover Saturday 3PM straight through to Monday at 7 AM).

Schedule another Windows Login report to run at exactly 7 AM the mornings of Tuesday - Saturday, spanning the previous 11 hours.

That will cover all of the off-hour blocks you listed.