log off time column in report

[sadhana]

Hi
how can i get logoff time column in the report.by default we get only login time when we click on the user details.If we need to build report,may i know what all should i include for getting logoff details.
I enabled security audit in eventlog scanning,I get logs but I need it in the table.
can u pls help

[Esben_D]

First, you will have to make sure that you scan non-error events from the event log. You can do this by following this knowledgebase article: https://www.lansweeper.com/kb/128/scanning-non-error-events.html

Then you will have to create a custom report. According to the following Microsoft article, a logoff is logged as event 4647: https://docs.microsoft.com/en-us/windows/device-security/auditing/event-4647

Eventlog information is stored in the following Lansweeper database tables (as mentioned in the database dictionary):

• tblNtlog
  
• tblNtlogFile
  
• tblNtlogMessage
  
• tblNtlogSource
  
• tblNtlogUser

[19257]

How do you go about creating this custom report to show logoff times?

[Hemoco · Accepted solution]

You won't be able to get it in this table, you will need to create a custom report to get the data you need.