Custom Logon tracking

[Samson]

Hi

Despite my best efforts, we seem to get a lot of pupils logging onto other accounts and fiddling with work etc.

Our Windows server Security logs only extend a day or so due to the sheer number of entries.

Is there any way of creating a custom log in the windows Event View whereby it just shows Logon and Logoff details?

i.e Date, Time, username and IP

just simple, viewable data that will store for a month for example.

I've noticed the event viewer's Security logs show Logon/Logoff entries 20-30 times per logon, hence why the logs get so cluttered.

any help would be appreciated, thanks.

[Ric_]

The easiest way is with a line like the following in a batch script:

 echo %date%,%time%,%username%,%computername% >> \\servera\share\logons.csv

Simple and will create huge text files.

[SYNACK]

If you use the above method you can even automate some of the reporting from it as you can query CSV files with SQL commands like a database from VBS, ASP or .net

[Samson]

That helps me greatly.

Thanks both!

[webman]

I developed a similar thing but it stores logins in a database and has a web front-end to query users, rooms etc. Download here.

Requires Apache/PHP/MySQL.
Edit the include/config.inc.php and fill in the appropriate MySQL details.
Edit the logon.vbs/logoff.vbs files to reflect the URL where you installed the web-based part.
Place vbs files where everyone can run them and set them to run at logon and logoff.

[mrbios]

Webman that seems almost perfect, just got one small problem in that i cant get it workin 100%

Is all the information meant to automaticly generate the relevant tables when someone logs on?

So far ive got the site running and connected to the mySQL server and the logon and logoff scripts attached to a test OU but i dont think there creating anything in the database

Error im getting: Message: MySQL Query fail: SELECT * FROM users ORDER BY username ASC MySQL Error: Table 'tracker.users' doesn't exist Date: Tuesday, October 7, 2008 at 2:30:58 PM Script: Message: Result set ID not freed. MySQL Error: Table 'tracker.users' doesn't exist Date: Tuesday, October 7, 2008 at 2:30:58 PM

getting one like that on each section on the main screen, is it important to have a username and pssword in the logon and logoff scripts and do they need any particular privees?

Using IIS, mySQL and PHP (with phpmyadmin for database maintainence)

[plexer]

Have you run the included .sql file from phpmyadmin against your sql server to generate the tables required?

Ben

[mrbios]

Have you run the included .sql file from phpmyadmin against your sql server to generate the tables required?

Ben

lol cheers

[mrbios]

got another issue, im using webmans logon and logoff scripts, getting this error popup:

though we are currently having a bit of replication issue resulting in things like DNS not working properly so i reckon its possibly to do with that

[webman]

Line 53 is xml.send lcase(strFormData).. not sure what could be causing that.

Is strHTTPUrl set to your web server address?
Also try replacing with this line:

xml.send strFormData

You don't have to log on and off all the time to test if it works, just run the script manually as a test user.

[mrbios]

Odd, it doesnt log anything if i run it manually on my machine

i'll have to look into it a bit more over the next few days, for now its home time

[webman]

It logs errors to the Event Viewer if that helps.

[mrbios]

Found the problem with that script error webman, at the same time as me setting this up we had alot of big replication errors, we had an external contractor fixing the replication while i did this and when he fixed it it replicated an old policy which didnt have the proxy exception for the server its installed on, all sorted now though

only other issue is getting people to show up correctly as staff and students, do i need to edit the logon/logoff scripts so that the names you have in there (EG "Student User") to what the user groups are called on our network?