Hi bob,

Sorry it's been so long between my posts. I almost forgot about this, because I figured out that the NTUSER.DAT.LOG file gets updated every minute while the user is actively doing something on the machine. Essentially what I meant by INACTIVE, was that the user has not performed any actions--or have any programs currently running (something that is actively writing/performing changes on something). I have found major problems with people not logging off of single signon environments, and leaving them locked for days at a time--all the while they're using other machines daily and doing the same thing over and over consuming unnecessary resources. This script was meant to find users that have been INACTIVE (nothing being done on the machine, just that the user is logged on) for over a specified time, that gets passed through by the batch file. I did some digging, and I found that the log file for the NTUSER database gets updated when the user is actively working on the machine, and does not update unless the user clicks in the environment, enters a keystroke, or a file is querying the registry keys. For now, it appears to work properly without issue. Thank you for your assistance! =]

Hmm, I think I may have worked with something like Net User before; however, I'm drawing a blank on what I did/how I read it. I believe I did the same thing you stated above, and parsed it out looking for keywords/times. What I'm trying to determine, is whether they are active vs inactive; unfortunately, it doesn't look like NET USER queries for this information. I know that task manager has the USERS tab which shows inactivity as well as for how long (like in terminal services), but I can't seem to find anything that I can use to access this--or what it's using to determine that a user is inactive. From what I was able to find on the NTUSER.dat, there was a suggestion made that the file was updated whenever there was any user activity (why I chose it), which I'm finding to be false--it seems to update randomly or at logon/logoff. I'm going to keep peeling through, and see if there is a WMI procedure that can pull this information for me (maybe from terminal services or task manager?)--no luck as of yet though. Thank you for your help so far!

Bob,

Thank you for the reply. I was able to find a few different WMI calls that perform the actions that I needed, and I'm able to gather information properly now. However, the issue I'm having now is with the NTUSER.dat file. From what I was able to find, I thought this file was updated whenever any actions were performed on the system--however, the file has updated on my test box since about 3:17pm EST. Would you be able to shed any light on this? I've tried to search google/forums for a better explanation of what this database does, and when it gets updated, but I couldn't find anything. is there a better system file that I could reference, which would get a more accurate time frame for when the user was last active? I was trying to find info in WMI for this, but I don't know if I was looking for the right parameters.