RE: user name from security logs

["dave kleiman" <dave () isecureu com>]

Download Log Parser at
http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-
91b2-f8d975cf8c07&displaylang=en

Install it.

Cut and paste this into notepad and save it as Logons.sql in the Log Parser
directory

-------------snip-------------------------

SELECT
       TimeGenerated AS TimeGenerated,
       TO_LOWERCASE(EXTRACT_TOKEN(Strings,13,'|')) AS SourceAddress,
       TO_LOWERCASE(EXTRACT_TOKEN(Strings,0,'|')) AS User,
       TO_LOWERCASE(EXTRACT_TOKEN(Strings,6,'|')) AS WorkStation,
       TO_LOWERCASE(EXTRACT_TOKEN(Strings,9,'|')) AS CallerDomain,
       CASE TO_INT(EXTRACT_TOKEN(Strings,3,'|'))
              WHEN 2 THEN  '2=Interactive'
              WHEN 3 THEN  '3=Network'
              WHEN 4 THEN  '4=Batch'
              WHEN 5 THEN  '5=Service'
              WHEN 6 THEN  '6=Proxy'
              WHEN 7 THEN  '7=Unlock'
              WHEN 8 THEN  '8=NetworkCleartext'
              WHEN 9 THEN  '9=NewCredentials'
              WHEN 10 THEN '10=RemoteInteractive'
              WHEN 11 THEN '11=CachedInteractive'
              WHEN 12 THEN '13=CachedRemoteInteractive'
              WHEN 13 THEN '14=CachedUnlock'
       END AS Type
INTO Logon.csv
FROM security
WHERE
       (EventID IN (528; 538; 540; 551; 552))
       AND
       (SourceAddress IS NOT NULL)
GROUP BY User,SourceAddress,CallerDomain,WorkStation,TimeGenerated,Type
ORDER BY TimeGenerated ASC

-------------snip-------------------------


At the command prompt in the Log Parser directory:
logparser file: Logons.sql

It will create Logon.csv in that directory.

For some really incredible Log Parsing scripts and techniques take a look at
Microsoft Log Parser Toolkit:
http://www.syngress.com/catalog/?pid=3110



Kind Regards,


________________________________________________________
Dave Kleiman, CAS, CIFI, CISM, CISSP, ISSAP, ISSMP, MCSE

www.SecurityBreachResponse.com www.ComputerForensicInvestigations.com
 











> -----Original Message-----
> From: Peter Rodger [mailto:prodger2008 () yahoo com]
> Sent: Tuesday, May 24, 2005 13:04
> To: security-basics () securityfocus com
> Subject: user name from security logs
>
> Hi, all
>
> Is there any way or any tools that we can find out which user
> logon or logoff from the network at specifc time through
> Windows 2000 security logs instead of going through each security log?
>
> Thanks in advance,
>
> Peter
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection
> around http://mail.yahoo.com