Software Use Auditing

[Cache]

I'm not quite sure where is the best place for this, but this will do for the moment.

I've been given a hyperthetical situation that someone would like me to find out what programs someone has used on a computer between a specific period.

So, the question is, how do you do it? I think I've read that Netsupport and Netop can both do this and log it centrally. I haven't found me Impero sales stuff to see if that can do it, but was also wondering if SCCM would do this too? Or is there a better, simpler, cheaper way of doing it? A method compatible with RDS would be usefull too since that is where I'm starting to push more.

Thanks

[russdev]

Impero can do this a logs it centrally... pretty sure netop and netsupport only log what is going on at moment and does not log it in a central place.

Russell

[Arthur]

SCCM can also do software metering...

http://technet.microsoft.com/en-us/l.../gg682017.aspx

After you collect usage data from Configuration Manager clients, you can view the data in different ways, which includes using collections, queries, and reporting. This data, combined with data from software inventory, can help your organization to determine the following:

• How many copies of a particular software program have been deployed to the computers in your organization. Among those computers, you can determine how many users actually run the program.
• How many licenses of a particular software program you have to purchase when you renew your license agreement with the software vendor.
• Whether users are still running a particular software program. If the program is not being used, you might retire the program.
• Which times of the day a software program is most frequently used.

[russdev]

Sorry that should of been Impero can do this and it logs it centrally...

[Cache]

Thanks for the replies, will get a trial of Netsupport next week so will see if it does what they claim and discussing Impero in a couple of weeks (I think, need to check my diary as to when I said call back).

@Arthur I'm not sure whether SCCM will go into the detail I need reading the summary you posted. I think what they were getting at was finding out if a specific person had used a specific bit of software - don't suppose you know if SCCM can provide that info do you?

[Arthur]

This is what gets logged in SCCM...

Once the software metering components have been configured, the policy information for the managed systems is updated. Every managed system within the site will be configured to monitor for when a metered program runs. During the client’s machine policy refresh, the new metering rules will be evaluated and the software metering client agent will start monitoring processes. When a monitored program runs, the agent records information within a log file. The details that are recorded are as follows:

1. File Information
   
   • File ID
   • File Name
   • File Version
   • File Description
   • File Size
   
   
   
2. Program Information
   
   • Company Name
   • Product Name
   • Product Version
   • Product Language
   
   
   
3. Usage Information
   
   • Start Time
   • End Time
   • Meter Data ID
   • Resource ID
   • User Name
   • Terminal Services User Session
   • Still Running Flag

For every start and end action, an entry is placed within the log file. When the scheduled upload time occurs, the client sends the log file to the site server. If for some reason the client is unable to contact the site server, the log files are stored on the managed system until communication with the site server is restored. Once communication has been restored, the client will upload the log file immediately.

The site server stores the log file until the summarization tasks run. You can configure when the summarizers run by configuring the properties of two tasks: Summarize Software Metering File Usage Data and Summarize Software Metering Monthly Usage Data. These two tasks are configured to run daily, as seen in Figure 9.31. If you have your schedules set up correctly, the client will send the data to the site server before the summarization tasks run. After the tasks have processed the log files and entered the data into the database, you will be able to run reports and view the software usage for the previous day and for the month.

The summarizers are responsible for converting the raw log data into concise data records within the database. All of the log files that have been uploaded to he site server are parsed and the usage information for each program is placed in the database. The Summarize Software Metering File Usage Data task is responsible for keeping track of the usage for each individual program over 15 minute and 1 hour intervals. The summarization task takes into account concurrent usage for programs. When a user starts and stops a program such as Microsoft Word, each action is recorded and then summarized. If the user starts and stops Microsoft Word within a 10 minute time frame on the same computer, one usage is recorded. If the same user starts and stops Microsoft Word on two different computers within that timeframe, then two usages are recorded. When you view the summarized data in the software metering reports, you will notice that the information that is summarized includes the program name, version, language, and number of distinct users that ran the program. The Summarize Software Metering Monthly Usage Data task condenses the log file data into the database. The data is evaluated for the past 30 days and keeps track of the total usage and usage patterns for each metered program. The data that is aggregated for this task includes the program name, version, language, running times, number of usages, last usage, user name, and computer name. (Source)