X-Spam-Check-By: sourceware.org
To: cygwin AT cygwin DOT com
From: "Joe Smith" <unknown_kev_cat AT hotmail DOT com>
Subject:  Re: "Last" or equiv for Windows login?
Date:  Thu, 4 May 2006 20:00:38 -0400
Lines: 42
Message-ID: <e3e4jb$daa$1@sea.gmane.org>
References:  <B7392353E4C4DE4ABC4EC255DB4CA04003471590 AT EXCHVS1 DOT spimageworks DOT com>
Mime-Version:  1.0
Content-Type:  text/plain; 	format=flowed; 	charset="iso-8859-1"; 	reply-type=original
Content-Transfer-Encoding:  8bit
X-IsSubscribed: yes
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com


"Bruce Dobrin" <dobrin AT imageworks DOT com> wrote in message 
news:B7392353E4C4DE4ABC4EC255DB4CA04003471590 AT EXCHVS1 DOT spimageworks DOT com...
Hi,

>Is there a flag for "last" or who or another program (cygwin or other)
>that shows me the current and/or previous Windows login user?  (Rather
>than the "last" cygwin shell login).  With a combination of cygwin tools
>and wmic  I have been able to log almost everything on any given remote
>machine...  But I can't figure out how to find out who is/was logged
>into the windows console (desktop or whatever you want to call it).  Any
>ideas?
>
>Thanks
>Bruce Dobrin

I assume you have the ability to install programs, and remotely run programs 
on the given remote machines.
You should be able to use a utility like Microsoft's logparser 
(http://www.logparser.com/) to do this.
Basically log parser allows you use SQL to search the event Log, among many 
other things.

logparser BLURB:
>Log parser is a powerful, versatile tool that provides universal query 
>access to text-based data such
>as log files, XML files and CSV files, as well as key data sources on the 
>Windows® operating system
> such as the Event Log, the Registry, the file system, and Active 
> Directory®. You tell Log Parser what
> information you need and how you want it processed. The results of your 
> query can be custom-formatted
> in text based output, or they can be persisted to more specialty targets 
> like SQL, SYSLOG, or a chart.
>
>Most software is designed to accomplish a limited number of specific tasks. 
>Log Parser is different...
>the number of ways it can be used is limited only by the needs and 
>imagination of the user. The world
> is your database with Log Parser.




--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/