Restrict Concurrent Logons using Domain Sessions?

[Nick_Parker]

It is to do with the .net securities... bugger

It's starting to look like I may have to rewrite it all as a vbscript, which is a pity, cause I was so proud of my little .exe

[Nick_Parker]

Originally Posted by SYNACK

I have not had issues with running exe files from the nelogon share but stuff like the old winnt printer connector exe.

You are probably having problems because your app is built in C# and relys on the .net framework which has a whole bunch of security settings that prevent running a .net application from a network share. You would need to change the .net runtime security settings on all of your client machines.

You can use VBS scripts to access databases directly and perform the kinds of operations that you are after which may be easier that a full scale war with the .net framework.

Using the VBS Script to access databases directly, you would use an ODBC connector rite? Seeing as this is a logon script run from a network share, would that ODBC driver need to be installed on each client?

[kesomir]

Why not use the vbs to call a webpage and pass info to it (in the url?), then process it using whatever script you like - asp, php etc.

Almost tempted to knock something up myself, but am against time atm.

EDIT: Or share from webserver and run a script file that way which does what you want

[Nick_Parker]

Originally Posted by kesomir

Why not use the vbs to call a webpage and pass info to it (in the url?), then process it using whatever script you like - asp, php etc.

Almost tempted to knock something up myself, but am against time atm.

EDIT: Or share from webserver and run a script file that way which does what you want

That's not a bad idea...

Could you elaborate a little more on the running a script from a webserver bit please?

The one thing that keeps niggling at me is that I need to just bite the bullet and do it properly using vbscript + odbc, i'm just worried about the ODBC availablility to connect to mysql on each client

[kesomir]

I run *nix webservers, so in my instance I would create a samba share with a batch file, php file, perl file etc that manipulates the database with the parameters it's passed.

The advantage first method of calling the webpage is that it's probably very familiar for the variable passing, but you may need to launch a webbrowser (then close it) to do it??

The second method is basically the same implementation as your .exe but calling a script on the webserver. This avoids the problems with your .net security. Advantage of doing it on *nix is that the script can be almost any flavour you want - including php.

If you were doing it on windows, you're a bit more restricted in the languages you can use - I don't know if you can execute php from the command line in windows but you can easily on a shell.

it would look something like this: calling 'concurrent_users.sh type username hostname'

#!/usr/local/bin/php -q
<?php

//grab the parameters

//type
$type = $argv[1];

//username
$username = $argv[2];

//hostname 
$hostname = $argv[3];

// execute the database call and make the write from the passed parameters

switch($type){
case 'logon':
//check to see if logged on and if time isn't beyond auto expire
//write logon data inc time etc
//allow logon
data['permit'] = TRUE;
//or not
data['permit'] = FALSE;
data['other_host'] = xxx;
break;

case 'logoff':
//delete instance of user on this hostname
break;
}

return $data;

?>

You then have to logoff immediately if the returned data is FALSE and you get the hostname backto give them a message "you are currently logged on to machine: xxx. Max Logons is X, you have exceeded this, you will need to log out of a machine to log in to this one. If you believe this is an error, please contact your system administrator - blah blah"

Thats a rough outline, the problems to solve would involve the returned data and the execution of the logon script.

EDIT: heh - easiest way would prob be using text files as an intermediary, which I think is the current solution. This sophisticates the whole thing by adding the database, configurable settings etc.

[SYNACK]

To access a MySQL DB you would need the ODBC connector installed on each machine, luckily though it is provided as a MSI so deploying it with GP would be a snap:
MySQL :: MySQL Connector/ODBC 5.1 Downloads

The web idea is an interesting one though as it would limit your requirements for connecting to only one server.

[azrael78]

The only issue I can see with using a DB of any kind is ghost sessions, where the kids don't bother to logoff but simply shut the PC down.

You might want to add some way to easily clear a session from the database if you are going to do it that way - as for me, I'm looking at a bunch of text files that can easily be deleted if we have issues or can easily free up sessions based on PC identity rather than user identity - but this is all ideas in my head and I need manglement approval to implement something like this.

Az

[amfony]

The only issue I can see with using a DB of any kind is ghost sessions, where the kids don't bother to logoff but simply shut the PC down.

Yeh - like i said it happens. Kids whom have the incentive to ask a teacher to ask us in IT gets cleared (i wrote a liveLogon app in autoIT to see who is on what computer at all times and made a simple click and delete record type deal).

Better yet (i think) is when a kid says "umm it says im logged in somwhere else" i can say "so what happened to the computer?" or "why did you press the power button?" and 90% of the time its a spot on inference. Also lets me know when a computer is freezing up etc.

To access a MySQL DB you would need the ODBC connector installed on each machine

Exsactly and exsactly. It does require a supplimentary install but it is so beautifully packaged that its a comprehesive non-event.

First problem: Can't run the EXE from the netlogon folder... all sorts of permission errors blah blah...

So for testing, the logon script now copies the exe to the local machine then runs it.
that seems to work fine, but still not ideal.

Ehh i think Synack's response might help you with some other auxilliary issues which i am useless to answer, but i have compiled all my logon scripts (as in AutoIT "compiled") and have them residing deep in the group policy folder strcuture in sysvol. And yes the DB manipulations run at logon and logoff, and computer start up and shutdown.

Hope this helps mate!

(PS: I actually quite like the web page medium for user logon/offs -- well done Kesomir)

[Nick_Parker]

Originally Posted by azrael78

The only issue I can see with using a DB of any kind is ghost sessions, where the kids don't bother to logoff but simply shut the PC down.

You might want to add some way to easily clear a session from the database if you are going to do it that way - as for me, I'm looking at a bunch of text files that can easily be deleted if we have issues or can easily free up sessions based on PC identity rather than user identity - but this is all ideas in my head and I need manglement approval to implement something like this.

Az

There will be a web front end which acts as a monitor as to who is logged on where (an advantage of having a DB store all the info)...
There will always be problems, but hopefully limiting concurrent logons will be a bigger benefit

[Nick_Parker]

Originally Posted by SYNACK

To access a MySQL DB you would need the ODBC connector installed on each machine, luckily though it is provided as a MSI so deploying it with GP would be a snap:
MySQL :: MySQL Connector/ODBC 5.1 Downloads

The web idea is an interesting one though as it would limit your requirements for connecting to only one server.

OK, i'm sorry, this is probably going to sound really daft, but how would I go about doing that? I've never used GP to install stuff, I usually hold off till the next ghost image, but that could be a long way off for the time being.
I tried reading up on it, the one article says that it isn't actually installed until a user tries to use it, what would happen if a script tried to call it?

[Nick_Parker]

Just an FYI : Getting a WSH vbscript to connect to MySQL is a mission in itself

Edit:

Turns out if you specify {MySQL ODBC 5.1 Driver } instead of {MySQL ODBC 3.51 Driver} it works better

[SYNACK]

Originally Posted by Nick_Parker

OK, i'm sorry, this is probably going to sound really daft, but how would I go about doing that? I've never used GP to install stuff, I usually hold off till the next ghost image, but that could be a long way off for the time being.
I tried reading up on it, the one article says that it isn't actually installed until a user tries to use it, what would happen if a script tried to call it?

You should just be able to put the msi file into a share that everyone including computer accounts has access to. Then you simply make a new group policy in gpmc or AD Users and computers assigned to the OU that your computers are in. Under Computer Configuration in this new policy you want to expand the Software Settings container and the Software installation container.

Right click on the Software installation container and select New > Package

Now navigate to were you stored the MSI using network accassable UNC paths like \\server\dist$ and select the msi file.

Under the install method you want to use "Assigned" as that will install the program at startup for all users.

It depends on how the package is built as to how it behaves but it is most likely to just install the whole thing when using this method, if not you could use Orca to create a MST file that would force it to.

The install relys on group policy refreshing before a system reboot so it can take up to three reboots of a client to start deploying. You can speed this up by typing gpupdate /force at the command line of the client which will do it immediately.

If it did not install completely it will depend on the package advertising that it can provide teh ODBC provider, if it does then when the script is run it will trigger a full install silently.

[kesomir]

Perhaps when you have it working you could post a howto on the wiki - or on the forums with teh code

[Nick_Parker]

Originally Posted by kesomir

Perhaps when you have it working you could post a howto on the wiki - or on the forums with teh code

It would be my pleasure

[Nick_Parker]

Success

I have a working vbs script that creates sessions in a MySQL DB, then deletes the session when the user logs off. You just call the script and enter the relevant arguments:

example:

in your logon script:

WSHShell.Run "\\FileServer\NetLogon\NetworkSessions\NetworkSess ions.vbs add " & objNetwork.username & " " & objNetwork.ComputerName & " " & strGroup, 0, TRUE

and in your logoff script:

WSHShell.Run "\\FileServer\NetLogon\NetworkSessions\NetworkSess ions.vbs delete " & objNetwork.username & " " & objNetwork.ComputerName, 0, TRUE

I am doing a some testing on it over the next few days, writing a readme, tidying up the code a bit and POSSIBLY a PHP Backend and then I'll upload to edugeek if people are interested?