If you're running Windows Server 2008 (R1 or R2), you can create a scheduled task based on events.
You'll have to do two things (I'm recalling this off the top of my head, so it may not be exact):
I. Set the server to audit logon events
1) Start -> Run -> type in
gpedit.msc and click OK.
2) Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Audit Policies
3) Enable "Audit Logon Events" and, I think "Audit Account Logon Events." Click OK and close out of the Group Policy Object Editor.
4) Start -> Run -> type in
cmd and click OK.
5) Type in
gpupdate in the command prompt and click OK.
II. Create an appropriate scheduled task
1) Manually log into your FTP server and see if something appears in the Event Viewer under "Security." If it does, make a note of the number and source. Now log off. See if something else appears. The source should be the same, but the number should be different. You'll need these for your Scheduled Task.
2) Start -> Administrative Tools -> Task Scheduler.
3) Create Task (not Basic task).
4) Check the check boxes that allow it to run whether or not a user is logged in and run with highest privileges.
5) Under the "Triggers" tab, click "New."
6) Set the trigger to fire "On an event." Select the source and number for the
logoff event that you noted during Step 1 above.
7) Go to the "Action" tab and select "Run a program." Select the script you want to run.
Click OK. Type in the appropriate user name/password to the server (one that has rights to run the task).
9) Test it out by logging in and out via FTP. See if the scheduled task fires.
If you wish to have me clarify some steps, let me know. I'll check a Server 2008 machine and get the exact verbiage if necessary.
