博主寫了一個小指令碼/工具（Github下載地址包含全部原始碼及pyinstaller轉的exe可執行程式），用來獲取域環境內所有使用者登入資訊，大家覺得不錯就收下吧，歡迎交流提建議。

本工具已更新，最新版請至Github下載

EventLogonStat.bat

@echo off
cd %~dp0
wevtutil qe security /format:text /q:"Event[System[(EventID=4624 or EventID=4634)]]" > EvtLogon.dat
EventLogonStat.exe EvtLogon.dat
del /F EvtLogon.dat
 

EventLogonStat.py

# -- coding:utf-8 --
# Python v2.7.10
# EventLogonStat.py
# Written by Gaearrow

import sys

# Logon Type Dictionary
logontypedic = {
    0 :'Unknown 0',
    1 :'Unknown 1',
    2 :'Interactive',
    3 :'Network',
    4 :'Batch',
    5 :'Service',
    6 :'Unknown 6',
    7 :'Unlock'
 
,
    8 :'NetworkCleartext',
    9 :'NewCredentials',
    10:'RemoteInteractive',
    11:'CachedInteractive',
}

# Logon ID Set
logonidset = set()

# Process Input
if len(sys.argv) != 2:
   print 'Usage: '
   print 'wevtutil qe security /format:text /q:"Event[System[(EventID=4624 or EventID=4634)]]" > EvtLogon.dat'
 

   print '%s EvtLogon.dat' % sys.argv[0].split('\\')[-1]
   sys.exit(1)
evt = sys.argv[1]
fevt = open(evt,'r')
flogon = open('LogonStat.csv','w')
print >>flogon,'Event No.; Task; Date; Account Name; Account Domain; Logon ID; Logon Type; Logon Address'

try:
    # Perform the Statistics
    numevent  = 0
    numlogon  = 0
    numlogoff = 0

    # For Eliminate redundancies
    lastdate   = 'lastdate'
    lasttask   = 'lasttask'

    for eachline in fevt:
        if eachline.find('Event[') > -1:
            # Reset
            evtno    = ''
            task     = ''
            date     = ''
            accname     = ''
            accdomain   = ''
            logonid     = ''
            logontype   = ''
            logonaddr   = ''
            skip = 0
            evtno = eachline.split('[')[1].split(']')[0]
            numevent = numevent + 1
        elif eachline.find('Date:') > -1:
            date = eachline[(eachline.find(':')+1):].strip()
        elif eachline.find('Task:') > -1:
            task = eachline.split(':')[1].strip()
            if (date == lastdate) and (task == lasttask):   ## reduce
                skip = 1
            else:
                lastdate = date
                lasttask = task
        elif eachline.find('Logon Type:') > -1:
            ltnum = int(eachline.split(':')[1])
            logontype = logontypedic[ltnum]
            if ltnum in [0,1,5,6]:  ## reduce
                skip = 1
        elif eachline.find('Account Name:') > -1:
            accname = eachline.split(':')[1].strip()
            if (task == 'Logon') and (accname.find('$') > -1):  ## reduce
                skip = 1
        elif eachline.find('Account Domain:') > -1:
            accdomain = eachline.split(':')[1].strip()
        elif eachline.find('Logon ID:') > -1:
            logonid = eachline.split(':')[1].strip()
            if (skip == 0) and (task == 'Logoff') and (logonid in logonidset):
                print >>flogon,evtno+';'+task+';'+date+';'+accname+';'+accdomain+';'+logonid+';'+logontype+';'+logonaddr
                numlogoff = numlogoff + 1
                logonidset.remove(logonid)
        elif eachline.find('Source Network Address:') > -1:
            logonaddr = eachline[(eachline.find(':')+1):].strip()
            if logonaddr == '-':    ## reduce
                skip = 1
            if (skip == 0) and (task == 'Logon'):
                print >>flogon,evtno+';'+task+';'+date+';'+accname+';'+accdomain+';'+logonid+';'+logontype+';'+logonaddr
                numlogon = numlogon + 1
                logonidset.add(logonid)

    # Print Summary Infomation
    print >>flogon,'============================='
    print >>flogon,'Summary Information'
    print >>flogon,'Logon  Event : ',numlogon
    print >>flogon,'Logoff Event : ',numlogoff
    print >>flogon,'Total  Event : ',numevent
    print >>flogon,'============================='
    print 'Event Statistics Success to LogonStat.csv'

except Exception as e:
    print 'Error: %s' % e
    sys.exit(1)

fevt.close()
flogon.close()

LogonStat.csv

Event No.; Task; Date; Account Name; Account Domain; Logon ID; Logon Type; Logon Address
1520;Logon;2017-03-27T12:38:38.941;Administrator;OHMYAD;0x4d7a3;Network;192.168.20.151
1521;Logon;2017-03-27T12:38:38.956;Administrator;OHMYAD;0x4d7b1;Network;192.168.20.151
1522;Logon;2017-03-27T12:38:38.972;Administrator;OHMYAD;0x4d7c4;Network;192.168.20.151
...
4579;Logoff;2017-03-27T21:50:29.703;aduser02;OHMYAD;0x32f922;;
4589;Logon;2017-03-27T21:51:49.559;aduser01;OHMYAD;0x332774;Network;192.168.20.151
4590;Logon;2017-03-27T21:51:50.074;aduser01;OHMYAD;0x332788;Network;192.168.20.151
...
=============================
Summary Information
Logon  Event :  142
Logoff Event :  133
Total  Event :  99908
=============================