Get the Network Administrators tool pack

Subscribe to our newsletter and get 11 free network administrator tools, plus a 30 page user guide so you can get the most out of them.

Search

Get an email notification on system logon

[画像:Post image for Get an email notification on system logon]

by Steve Wiseman on January 14, 2011 · 27 comments

in Microsoft,Tips,Windows 2008,Windows 2008 Core,Windows 2008 R2,Windows 7

I was digging around to find a way to get an email when someone logged on to our source control server. It is a pretty important server, so I want to make sure people are only logging into it when they are supposed to.

When I first started working on this idea I was going to write a custom application, and use that along with blat. Blat is an email sending program that can be used from the command line.

I was surprised that I could get exactly what I wanted, without any third party application. This works for 2008, Vista, and Windows 7 – if you are still running Windows 2003 you will need to cobble together a collection of apps that will accomplish this (Sorry)

Start out by opening the event viewer. Right click on the security log on the left hand side. Click on the menu item that says “Attach a task to this log”, and a task wizard will be displayed.

Security Log Attatch an Event

Type in a description for your task:

Logon Email Notification Description

This page is annoying. I have not had time to test on other systems. But on mine all the fields are disabled. It would be nice if I could enter the info I wanted here. Instead we will need to go into the advanced settings of the task – more on that in a little bit. Just click next.

Logon Email Notification Source

See. There is our option. Send an email. You could launch a program too, or have a message pop up for a specific user

Logon Email Notification Selection

Fill out your email settings. I pointed it at our internal exchange server:

Logon Email Notification Server Settings

Very important Don’t miss this one. Make sure you check the option to open advanced properties. Otherwise you will get an email message for every entry in the security log:

Logon Email Notification Change Settings

Click finish, and the advanced properties are displayed. Set the task to always run. Otherwise it would only run while you are logged on – and that would be silly

Logon Email Notification Run Always

Go to the “Actions” tab, and double click on the only action listed

Logon Email Notification Setting Properties

Set your source as “Microsoft Windows security auditing.” And your event ID number as 4624 (You can use 4634 for logoff)

Logon Email Notification Filter Settings

Click OK and you are done. When someone logs on to your system, you will receive an email notification with all of the event info.

The best part about this tip is that you don’t need any third party apps – it is all built into Windows.

One more thing…Subscribe to my newsletter and get 11 free network administrator tools, plus a 30 page user guide so you can get the most out of them. Click Here to get your free tools

{ 27 comments… read them below or add one }

1 Kerrio Bartlette February 4, 2011 at 12:21 pm: Thanks,
But does it show the user that has actually logged on to the server?

just a small note:

Go to the "Actions" tab, and double click on the only action listed

should be:

Go to the "Triggers" tab, and double click on the only action listed
2 Angurajesh.K March 1, 2011 at 4:47 am: Hai, how to hide client system ip address to the intelliadmin by using clinet? is there any possible?
3 gbh July 19, 2012 at 12:04 pm: any idea how to have the script differentiate between a real meat world log on and a log on by Advapi?
They both generate an event ID of 4624 so I get hit with loads of emails.
Look for a way to lock it down to human log on only.
TIA.
4 Steve Wiseman July 19, 2012 at 1:54 pm: The logon type for people sitting in front of the machine is 2.

This article shows how to get a report of this…use the script mentioned in the article and you should be able to modify it for your needs:

http://www.intelliadmin.com/index.php/2012/07/see-who-logged-on-to-a-computer-and-when/
5 Manish July 27, 2012 at 2:07 pm: how do i remove it ??
urgent
6 Steve Wiseman July 31, 2012 at 6:46 pm: Hello Manish,

What are you trying to remove?

Thanks,

Steve
7 KAUSAR August 2, 2012 at 2:26 am: Thanks
8 momzie September 9, 2012 at 5:57 pm: Guys any idea how can i disable this alerts created under event viewer. This is just filling up my mail box every second. Please help
9 Kathy October 6, 2012 at 9:32 pm: Is there any way to get an email when someone logs off? I just need this feature once a month when I’m doing regular maintenance. Too many users working via VPN all day long to let me boot the server anymore.
10 Amit October 27, 2012 at 6:25 pm: Hi,
I get the email notification but i don’t get any detail of login, could you please advise ? I expect to receive at least the ip address and time of login.

Thank you
Amit
11 Ram March 6, 2013 at 5:33 am: Dear Support,

I am not able to send mail from security log
______________________________________
Task Scheduler failed to complete task “\Event Viewer Tasks\Security” , instance “{82e2e8a3-51db-48e4-9cdb-9c657b476b1f}” , action “login mail” . Additional Data: Error Value: 2147746321.

This error we are receiving kindly help I really appreciate for your help

Thanks
Ram
12 Steve Wiseman March 6, 2013 at 10:08 am: That error message 2147746321 means: CDO_E_SMTP_SEND_FAILED

This means you can’t send mail through the server. I would check the script by hand before running it as a task and see where the issue is.
13 Mohammed May 6, 2013 at 4:11 am: How to delete the created event in the security please its urgent
14 Mohammed May 7, 2013 at 3:11 am: How to delete the created event in the security please its urgent hurryyyyy
mr.Steve Wiseman
15 Steve Wiseman May 9, 2013 at 9:29 am: Hi Mohammed,

You can’t delete one event. MS has built it this way for security reasons. You would just need to clear the entire log…but then someone would notice that 🙂
16 Sam June 1, 2013 at 8:41 am: Hi,
I want to know, how can you send an e-mail without your smtp credentials. I’m trying to create a scheduled task but this task can not send an e-mail (because I didn’t write my password etc.)
Thanks
17 Terry August 8, 2013 at 4:44 pm: How to do you modify this task. I am receiving way too many e-mails all night long from this task?
18 Michael August 30, 2013 at 6:56 am: For those of you who don’t know how to delete a task go into task scheduler – (administrative tools > Task Scheduler) and click on the task library select the task and delete it.

Also if you wan a way that won’t spam you to death setup the task manually however set the trigger to “At log on” instead of on events. Also add in 2 more trigger for “On Connection to user session” 1 for remote and 1 for local.

This way you will only get genuine logons and not from every time somebody connects to a file share or uses some other server resource.
19 Srieksh Maharaj December 13, 2013 at 7:00 am: Excellent! Works great, is there no way to pull the users info? I mean we have over 50users in my organisation… Is there no way to pull each user name?
20 Mike December 23, 2013 at 9:18 pm: Good Job, Worked Perfect, Also thanks to Michael for the complement.
21 Trab Nacnud June 17, 2014 at 3:05 pm: Sweet. I needed to do the exact same thing for login notification, and I had no idea this feature existed. Thanks!
22 Hitesh July 19, 2014 at 2:21 pm: I just got an pop up error message saying:
An error has occured for the task user logon email notification. Error message: User account restriction error. The possible reasons are that blank passwords not allowed, or that a policy restriction has been enforced.
23 Atul August 14, 2014 at 8:02 am: Hello All,
I followed the steps and configured the alerts.

I did log off and log in on to the server but still I have not received any email Alert
24 Erik June 23, 2015 at 8:02 am: You should use event ID 4648 or you will have the mailbox flooded with emails 😉
25 Brian November 4, 2015 at 12:46 pm: Is this possible using gmail smtp? Our organization uses google for work.
26 Neringa February 11, 2016 at 7:16 am: Guys, i have problem with Windows 10, any Ideas? because this feature have been removed…
27 mike February 29, 2016 at 10:48 am: Apparently, it’s deprecated in windows 10.

Subscribe

Recent Posts

Search

Archives

Get an email notification on system logon

Related Articles: