Track user logons?

[CHR1S]

Wouldnt it be a little safer to map a drive, write to it then unmap it in the same script? Its a little time consuming but if it was hidden in the background it should be ok?

[projector1]

just been reading my WindowsITPro mag for june and saw this article

http://www.windowsitpro.com/Articles...922/95922.html



the article covers a story of a IT pro who developed a solution for his firm to see who's logged in. It also contains a nice comment from another Pro who has his own method of seeing who's logged in

[ZeroHour]

Yeh but it has the same limitations as most of the other solutions, that why I made my own
I have a few people now and we are testing it with different systems to make a guide before releasing it.
Any ideas for names?

[ChrisP]

This is the VB script i knocked up to 'keep an eye on things'.....
I have a few scripts that run, this one is mainly used for logging to a access database.

Then i got a nice web front end written for it that alerts me to things such as double logons, lets me probe this database in many ways, Thats part of my asp command and control centre i knocked up (winsuite logging, dhcp probe, user (adsi) admin, proxy logging etc.)



OK, OK - i know how messy it is. Yes i know i got Lazy on declarations (etc). However it works very well for me, maybe you can use/abuse/break it in some way.



_____________________________

On Error Resume Next
dim strKey, wshShell, intValue
Set WshShell 			= WScript.CreateObject("WScript.Shell")
Set FSO             		= CreateObject("Scripting.FileSystemObject")
Set WSHNetwork          	= WScript.CreateObject("WScript.Network")
Set objNet			=	CreateObject("wscript.Network")

strKey = "HKEY_LOCAL_MACHINE\SOFTWARE\Intel\Display\igfxcui\HotKeys"
wshShell.regWrite strKey, 0, "REG_DWORD"


strKey = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride"
wshShell.regWrite strKey, "gatekeeper1;*.earlham.local;<local>", "REG_SZ"


	oUN			=	objNet.UserName
	objHost			=	objNet.ComputerName
	strUserName             = ""

Set adoCon = CreateObject("ADODB.Connection")
While strUserName       = ""
WScript.Sleep 100
strUserName             = WSHNetwork.UserName

Wend

'---------------------------------
	Set OSSet = GetObject("winmgmts:").InstancesOf("Win32_OperatingSystem")
	For each OS in OSSet
	Spack=OS.CSDVersion
	if Spack="" Then Spack="Data not available"
	Next
'---------------------------------
	Set objFSO		= 	CreateObject("Scripting.FileSystemObject")
	targetFolder		=	"c:\documents and settings\"
	Set objFolder 		= 	objFSO.GetFolder(targetFolder)
	Set colFiles 		= 	objFolder.subFolders
	countFolders		=	0		
	For Each objFile In colFiles
	countFolders		=	countFolders + 1		
	Next



strUserDomain           = WSHNetwork.UserDomain
Set ObjGroupDict        = CreateMemberOfObject(strUserDomain, strUserName)


			StartTime			=	time()
			sDomain 			= 	"domain"
			sGroupSelected 		= 	"Domain Users"
			sUserSelected 		=	strUserName
set objGroup 					= 	GetObject("WinNT://" & sDomain & "/" & sGroupSelected)
For Each objUser in objGroup.Members
			oNA					=	objUser.Name
			
	If 	objUser.Class = "User" and oNA = sUserSelected Then
			oFN					=	objUser.FullName		
	oAD					=	objUser.AccountDisabled	
			oLL					=	objUser.LastLogin		
			oLS					=	objUser.LoginScript
			oHD					=	objUser.HomeDirectory
			oDS					=	objUser.Description
		
						
	Exit For

			

	End If
Next	
	
adoCon.Open "Driver={Microsoft Access Driver (*.mdb)};DBQ=\\10.96.172.10\logging$\database\logon_watch.mdb"
Set oRS = CreateObject("ADODB.Recordset")
strSQL = "SELECT * FROM logons;"

oRS.CursorType = 2
oRS.LockType = 3

oRS.Open strSQL, adoCon
oRS.AddNew
oRS.Fields("user")  		=   oUN	
oRS.Fields("pc")  		=   objHost					
oRS.Fields("date")  		=   date()
oRS.Fields("time")  		=   Time()
oRS.Fields("domain")   		= strUserDomain           
oRS.Fields("servicepack")	=	Spack
oRS.Fields("profiles")		=	countFolders 
oRS.Fields("logonscript")  	=   oLS	
oRS.Fields("lastlogon")  	=   	oLL
oRS.Fields("fullname")  	=   	oFN
oRS.Fields("description")  	=   oDS
oRS.Fields("homedirectory")  	= oHD  
oRS.Fields("simsversion")  	= objFSO.GetFileVersion("c:\program files\sims\sims .net\pulsar.exe")
oRS.Fields("vncversion")  	= objFSO.GetFileVersion("C:\Program Files\RealVNC\VNC4\winvnc4.exe")
oRS.Fields("savversion")  	= objFSO.GetFileVersion("C:\Program Files\Sophos\Sophos Anti-Virus\SavMain.exe")
' oRS.Fields("flashversion")  	= objFSO.GetFileVersion("")

If MemberOf(ObjGroupDict, "staff") Then 
oRS.Fields("staff")	=	"TRUE"
End If


If MemberOf(ObjGroupDict, "students") Then
oRS.Fields("student")	=	"TRUE"
End If


If MemberOf(ObjGroupDict, "Watch") Then
oRS.Fields("watch")	=	"TRUE"
End If


oRS.Update
oRS.Close

Set oRS = Nothing
Set adoCon = Nothing



Function MemberOf(ObjDict, strKey)
MemberOf = CBool(ObjGroupDict.Exists(strKey))
End Function

Function CreateMemberOfObject(strDomain, strUserName)
Dim objUser, objGroup
Set CreateMemberOfObject    = CreateObject("Scripting.Dictionary")
CreateMemberOfObject.CompareMode = vbTextCompare
Set objUser = GetObject("WinNT://" & strDomain & "/" & strUserName & ",user")
For Each objGroup In objUser.Groups
CreateMemberOfObject.Add objGroup.Name, "-"
Next
Set objUser = Nothing
End Function