Logging pupils computer activity

[Chriss31]

Firstly apologies if this is in the wrong forum.

I was hoping for some advice on available software for the logging of logon/logoff activity of the pupils at our school.

We made the quite amateur mistake of having certain PC's in the school still running the XP messenger service, and so a message was sent out by a pupil earlier to staff members using Net Send. Whilst we can tell from the message which machine it was, we have no conclusive proof of who it was because we have no way of logging these details.

Many thanks

[Michael]

If you know which machine it came from, then check the event log for "Application Popup" under System.

It'll list the date and time the message was sent, but also what was sent. I just performed a small test sending a message to myself and the user came up N/A which is a little odd.

[Chriss31]

What I should have mentioned is that we have HD Guard installed which as you may be aware deletes all locally created content upon restart of the PC, which the pupil had done. What I was looking for was something server-side that could log all connections/disconnections.

Thank you for your help thus far.

[mrforgetful]

We use AB Tutor Control here which you can set to log that, it will also log programs run, websites visited, print jobs...

Can turn the internet off and on too, limit websites, view screens etc. Bargain price too as you only pay for the 'Teacher' part of the program which cna monitor any number of clients, around £100...

[Michael]

Deleting the event logs isn't something I really do that often. I actually find them very useful for identifying all kinds of problems.

Other policies you should look into -

User Config > Admin Templates > System

Prevent access to the command prompt - Enabled and specify No for script processing

I'd also recommend you completely disable the Messenger service and use a VLE or something similar for staff to communicate/post messages. You could also disable Notepad and .bat or .vbs files from running using Software Restriction Policies.

[mrforgetful]

How come you even have that service enabled? It's disabled by default as of SP2...

Disable it using a policy.

[Chriss31]

I have absolutely no idea why this issue hasn't been dealt with a long time ago (I've not been here long). The reason some machines still have messenger running is (as far as I'm aware) that certain machines don't have SP2 installed on them.

We already have restriction policies in place to prevent pupils from running .bat or .vbs files, so we're moving in the right direction.

Having had a quick look at AB Tutor Control it sounds like quite a fantastic piece of software, and offers a lot of functionality for the price. I assume software will be required to be installed on every client machine.

[Dom_]

Yeah theres a client version that comes as an MSI, very simple to deploy.

I used it at my last place and can't recommend it more, it does however seem to have issues occasionally when more than one teacher is watching the same room.

It has some great features and the application blockers are awesome!

Also unlike most monitoring software, the kids can't tell if they're being watched, there isn't even a screen flicker

Dom

[Michael]

that certain machines don't have SP2 installed on them

You need to get that sorted ASAP as XP is upto SP3 (as you may know)

[Zimmer]

We use AB Tutor Control too - Fantastic application for the staff/teachers, especially when they are in the large Learning Centers where they can't see all the workstations screens.

[p858snake]

is (as far as I'm aware) that certain machines don't have SP2 installed on them.

Your first concern before doing anything else is re-ghosting all the machines with at least SP2 preferably SP3 and fully updated. and then deal with the logging issue (this thread should help: Record Logon but some method that would write to some sort of database (mysql maybe?) would be better and cleaner i think)

[Bezwick]

We use a couple of batch files i created to create a record of which pupils log on and off and when. Its a bit clunky, but its free, and works well.

Add this as a logon script

echo %date% %time% %computername% %username% Logon>>\\server1\logon$\pupils\%USERNAME%.txt
echo %date% %time% %computername% %username% Logon>>\\server1\logon$\computers\%computername%.t xt

and add this as a log off script

echo %date% %time% %computername% %username% Logoff>>\\server1\logon$\pupils\%USERNAME%.txt
echo %date% %time% %computername% %username% Logoff>>\\server1\logon$\computers\%COMPUTERNAME%. txt

seams to work fine for us, give it a try and see what ya recon.

Just remember to add the $ sign after the server share as, with pupils needing read/write permissions if they know what they are doing they could erase their tracks.

Good luck

[Chriss31]

Thanks everyone for your responses, it is much appreciated. Why we have pre-SP2 machines here I don't know!