Track user logons?

[Jon1]

In Server 2003 is there any way i can track who is logging on when and/or where? We have an issue where one of our staff members seems to be logging on as another user, or as themsleves at strange times?

[Geoff]

You can do this via audit logging.

[djm968]

Try these VB Scripts

Logon.vbs

Const ForReading = 1, ForWriting = 2, ForAppending = 8 
Set objNetwork = CreateObject("Wscript.Network") 

   Dim fso, f 
   Set fso = CreateObject("Scripting.FileSystemObject") 

'alter the path to the file as needed for your environment 

strNewFile = "C:\Userlog" & Replace(FormatDateTime(Now(), vbShortDate) & ".csv", "/", "") 

Set f = fso.OpenTextFile(strNewFile, ForAppending, True)

strComputer = objNetwork.ComputerName 
strUser = objNetwork.UserDomain & Chr(92) & objNetwork.UserName 

'alter the text strings as you like 
f.Write strUser & "," & strComputer & "," & Date & "," & Time & "," & "Logon" & vbCrLf
f.Close

Logoff.vbs

Const ForReading = 1, ForWriting = 2, ForAppending = 8 
Set objNetwork = CreateObject("Wscript.Network") 

   Dim fso, f 
   Set fso = CreateObject("Scripting.FileSystemObject") 

'alter the path to the file as needed for your environment
strNewFile = "C:\Userlog" & Replace(FormatDateTime(Now(), vbShortDate) & ".csv", "/", "") 

Set f = fso.OpenTextFile(strNewFile, ForAppending, True)

strComputer = objNetwork.ComputerName 
strUser = objNetwork.UserDomain & Chr(92) & objNetwork.UserName 


   'alter the text strings as you like 
   f.Write strUser & "," & strComputer & "," & Date & "," & Time & "," & "Logoff" & vbCrLf
   f.Close

These scripts log the username, computer name, time, date and the event to a date coded csv file.

I would recommend that CSV file is located on a server share and the path to the file modified for both scripts.

[tarquel]

Can it be a UNC path then for the logfile?

Nath.

[djm968]

Can it be a UNC path then for the logfile?

Nath.

Yes, however the user will need write access to the UNC path if the scripts are executed at user logon\logoff

[strawberry]

echo %date% %time% %computername% %username% >>\\servername\logon\log.txt

tack that onto your logon script. works a treat.

[ZeroHour]

I created my own system based on autoit and php/mysql
It logs times when people log on, where they are, when they leave and I have it projected onto a wall giving the current amount of staff,pupils and the amount of pc's logged onto this week (like 200/500).
Its web based for viewing the DB and you can wildcard search for pcs and users.
I can provide the info you need to enable your network to do it.

[kearton]

i'd be very interested in that, ZeroHour... (as I'm sure many others would)

[mark]

Sounds great ZH - how much can I pay you!

[ZeroHour]

Cool, if there is a interest I will work on a pack for some people to test.
PM me if you would like to help beta test. MSN Messenger users are v welcome as its faster for debugging.

Mark I accept beer like all good techies

[Jon1]

echo %date% %time% %computername% %username% >>\\servername\logon\log.txt

tack that onto your logon script. works a treat.

Ive tried that but it doesnt seem to work?

[Jon1]

Try these VB Scripts

Logon.vbs

Const ForReading = 1, ForWriting = 2, ForAppending = 8 
Set objNetwork = CreateObject("Wscript.Network") 

   Dim fso, f 
   Set fso = CreateObject("Scripting.FileSystemObject") 

'alter the path to the file as needed for your environment 

strNewFile = "C:\Userlog" & Replace(FormatDateTime(Now(), vbShortDate) & ".csv", "/", "") 

Set f = fso.OpenTextFile(strNewFile, ForAppending, True)

strComputer = objNetwork.ComputerName 
strUser = objNetwork.UserDomain & Chr(92) & objNetwork.UserName 

'alter the text strings as you like 
f.Write strUser & "," & strComputer & "," & Date & "," & Time & "," & "Logon" & vbCrLf
f.Close

Logoff.vbs

Const ForReading = 1, ForWriting = 2, ForAppending = 8 
Set objNetwork = CreateObject("Wscript.Network") 

   Dim fso, f 
   Set fso = CreateObject("Scripting.FileSystemObject") 

'alter the path to the file as needed for your environment
strNewFile = "C:\Userlog" & Replace(FormatDateTime(Now(), vbShortDate) & ".csv", "/", "") 

Set f = fso.OpenTextFile(strNewFile, ForAppending, True)

strComputer = objNetwork.ComputerName 
strUser = objNetwork.UserDomain & Chr(92) & objNetwork.UserName 


   'alter the text strings as you like 
   f.Write strUser & "," & strComputer & "," & Date & "," & Time & "," & "Logoff" & vbCrLf
   f.Close

These scripts log the username, computer name, time, date and the event to a date coded csv file.

I would recommend that CSV file is located on a server share and the path to the file modified for both scripts.

Im sorry, i dont know VB. Ive nver really looked at it so i dont know that to do with the information you have given me! ops:

[ZeroHour]

The biggest problem with these scripts are that if a pupil wants to be evil he can clear the logs as he has permissions. I know I would look/find it if I was going to do damage.

Let me rephrase my beta call-out, I need people to help me make sure its generic for every network before I release it to the wild. I dont see any problems but best to test
Its fairly simple and since its web based primarily, it should not effect your network running it. It works good for us and kids would have a v hard time faking entries.

Added: This post has a couple of screenie showing 2 aspects of the sys.

[Geoff]

OCS Inventory logs user logins.

[ZeroHour]

Oooh having a look. Does it log logout times?