Friend of mine wrote this and yes it would not port over perfectly but the idea is there as all this data can be sent to a database and upon login you could use a script of if else's and check how frequent and from where and when a person logs in and out. Change the INTERNAL IP's used in the script and some minor stuff and add database queries and you have something @echo off set yyyy=%date:~10,4% set dd=%date:~7,2% set mm=%date:~4,2% REM ## Edit this path to reflect this environment ## set share=\\\\\\\\\\\\\\\\10.0.0.200\\\\\\\\scratch\\\\\\\\logins\\\\\\\\%yyyy%\\\\\\\\%mm%\\\\\\\\%dd%.csv for /f "Tokens=2 Delims=[]" %%i in ('ping -4 -n 1 "%computername%"') do set IP=%%i set qry=where "ipenabled=true" set params=description^^,ipaddress^^,macaddress^^,MTU for /f "usebackq skip=2 tokens=1-4 delims=," %%a in ( `wmic nicconfig %qry% get %params% /format:csv ^<nul^|find /v "0.0.0.0"` ) do set MAC=%%d REM ## Edit these paths to reflect your environment ## if not exist \\\\\\\\\\\\\\\\10.0.0.200\\\\\\\\scratch\\\\\\\\logins\\\\\\\\%yyyy%\\\\\\\\%mm% ( mkdir \\\\\\\\\\\\\\\\10.0.0.200\\\\\\\\scratch\\\\\\\\logins\\\\\\\\%yyyy%\\\\\\\\%mm% if not exist %share% ( @echo %Date%, %TIME%, %username%, %computername%, %IP%, %MAC% >%share% ) else ( @echo %Date%, %TIME%, %username%, %computername%, %IP%, %MAC% >>%share% ) ) else ( if not exist %share% ( @echo %Date%, %TIME%, %username%, %computername%, %IP%, %MAC% >%share% ) else ( @echo %Date%, %TIME%, %username%, %computername%, %IP%, %MAC% >>%share% ) ) At the very least...makes ya think that punishing server hoppers is possible.