How to find out which machine a student logged onto, & when

[indiegirl]

AD on Server 2003, I've Googled this with a few snippets of information but nothing that's come up with the full answer.

 

Basically, I need to know when a user last logged on, and the machine name of the logon point.

 

Is there a script or two that could do this?

 

TIA (as usual! I seem to request a lot but contribute little... :oops: )

[webman]

You can use the event viewer to find this out on individual machines (connect to remote computer and view the security events) but to do this centrally you're probably looking at some third party software.

[wesleyw]

I've got a few scripts that when pupils log onto a PC it creates a running text file with machine name time date etc.. As well as username of course would this be of any use to you? You'd have to put it in to the Login and logoff scripts section of the GPO though?

 

If it'll help let me know and I'll dig it out for you!

 

Wes

[indiegirl]

Wes, that'd be super - anything would do to start... cheers!

[Ric_]

@indiegirl: ChrisH has a very advanced scripting thing involving a MySQL logging system and the ability to limit logins - I'm sure he'd love to share it with you

[DMcCoy]

@indiegirl: ChrisH has a very advanced scripting thing involving a MySQL logging system and the ability to limit logins - I'm sure he'd love to share it with you

 

The MS one?

[ChrisH]

No not that one cconnect or whatever it's called. Its one I was putting together myself but never got round to finishing. It's basically an improvement of the limit logon script I posted in the scripts forum. It uses database queries rather than text files. I did it this way so I could eventualy put a web front end on it to do queries.

One day soon I will get round to finishing it just not had the chance to sit down and do it lately

[wesleyw]

Yeah I was doing one of those but sorry to say using M$ (No)Access the text file one is just more reliable at the moment once I've finished the DB one I'll let you know!

 

Wes

[DMcCoy]

I've never tried it but ms do a limit logon app, this is from the help. Needs a sql server though afaik

 

LimitLogin v1.0

 

 

LimitLogin is an application that adds the ability to limit concurrent user logins in an Active Directory domain.

 

It can also keep track of all logins information in Active Directory domains.

 

 

 

LimitLogin capabilities include:

 

· Limiting the number of logins per user from any machine in the domain, including Terminal Server sessions.

 

· Displaying the logins information of any user in the domain according to a specific criterion (e.g. all the logged-on sessions to a specific client machine or Domain Controller, or all the machines a certain user is currently logged on to).

 

· Easy management and configuration by integrating to the Active Directory MMC snap-ins.

 

· Ability to delete and log off user session remotely straight from the Active Directory Users and Computers MMC snap-in.

 

· Generating Login information reports in CSV (Excel) and XML formats.

[ChrisH]

Weve seen that before but it involves changes in AD and at the time we were dicussing it nobody was brave enough to test it

[DMcCoy]

Perhaps I'll try it

[mikeingham]

We use LimitLogin. It was typical Microsoft to set up. i.e. jump through 26 hoops, have the right updates installed etc.

 

But now it is on it is very easy to use, and has stopped password sharing for the kids, and leaving laptops logged in for the Staff.

 

It just does what it says on the can :!:

[Michael]

I use an application called Userlock 3.0. It supports 2000/2003 Server and 2000/XP clients. Its prime job is to limit concurrent logons either at user or group level, but it does clearly state the last time, date and workstation a user logged on and logged off.

[MkII]

Woah - £2300 for 1000 users - and thats WITH the educational discount!!!

 

[userlock 3]

[MkII]

Is this the limitlogon you're talking about?: http://www.thincomputing.net/newsitem296.html

[kevinmcaleer]

I used to use one a few years back, basically on the Domain controller write a small VBS file as follows

 

CurrentDate = Now

cmdstr = "cmd /c net session > " & DatePart("YYYY",CurrentDate) & "." & DatePart("M",CurrentDate) & "." & DatePart("D",CurrentDate)

cmdstr = cmdstr & "-" & hour(CurrentDate) & "." & minute(CurrentDate) & "." & second(CurrentDate) & ".txt"

dim WShell

 

Set WShell = CreateObject("WScript.Shell")

 

WShell.Run cmdstr

 

Add this file to task scheduler on the domain controller and run it every 5 minutes. You can change the location of the logfiles by adding a path just after the ">" on the second line of the script. You'll then have a folder full of logfiles, but if you compress the folder that they are in, they hardly take up any space at all. the contents of each log file state the username, computername and date and time stamp.

 

I could make this script create a new folder each day etc but to keep things simple it's "as it".

 

I've just tested this on my home server (2003) at it works fine.

 

-Kev

[DMcCoy]

That is indeed the limit login that I was taking about. Downloaded it ages ago but didn't have a sensible server to run the sql at the time. Its probably on the ms site somewhere (you know how they like to move things).

[ChrisH]

It says it doesnt need SQL it uses AD. You must be thinking of CConect.

[DMcCoy]

It says it doesnt need SQL it uses AD. You must be thinking of CConect.

 

It could be, its been a while and I was looking at several at the time. Must be too busy

 

Come to think of it thats probably why I downloaded it and got rid of the others.

[wesleyw]

@indiegirl

 

I think I've messed up the file upload section I'll have to wait and see. If you want the scripts I can email them to you?

 

I finally found them on an old PC at home lol

 

Wes

[kevinmcaleer]

CurrentDate = Now

cmdstr = "cmd /c net session > " & DatePart("YYYY",CurrentDate) & "." & DatePart("M",CurrentDate) & "." & DatePart("D",CurrentDate)

cmdstr = cmdstr & "-" & hour(CurrentDate) & "." & minute(CurrentDate) & "." & second(CurrentDate) & ".txt"

dim WShell

 

Set WShell = CreateObject("WScript.Shell")

 

WShell.Run cmdstr

 

My script does what the post asks! Its free and doesn't need anything like mySQL to work. you just run the script and it will tell you who is logged on and where. schedule it to run and you have a (searchable) history.

 

-Kev

[indiegirl]

No major rush, I managed to find a VB script on the web in the end (it ended up being a rush job.. as usual!) that pointed me to when a user last logged in, the machine they were on became irrelevant.

 

Damn year 11s (supposedly on study leave) coming in and logging on as staff... and the staff member had the cheek to tell me that he must've "hacked into the system"!!!

 

He's being hauled over the coals.. and on the last day of term, silly boy...

[GrumbleDook]

lol, we've just had 2 students using a staff account, accessed our VLE and pulled of the temporary lunch pass template that we use to allow kids out.

 

It got sent around Year 10 and when we tracked it back we found it was in a dept office and the user had saved their password on the VLE client (he had updated the client settings file with one we give to staff students at home which does allow them the save function)

 

The kids are out for a day and the member of staff has been talked to ...

[wesleyw]

Got it added finally bloody browser!

 

You'll need to change the admin password and where to store the files but its well commented. It will need compiling using VB6 though. If you need any help with it let me know!

 

Wes

scripts.zip

[MkII]

CurrentDate = Now

cmdstr = "cmd /c net session > " & DatePart("YYYY",CurrentDate) & "." & DatePart("M",CurrentDate) & "." & DatePart("D",CurrentDate)

cmdstr = cmdstr & "-" & hour(CurrentDate) & "." & minute(CurrentDate) & "." & second(CurrentDate) & ".txt"

dim WShell

 

Set WShell = CreateObject("WScript.Shell")

 

WShell.Run cmdstr

 

My script does what the post asks! Its free and doesn't need anything like mySQL to work. you just run the script and it will tell you who is logged on and where. schedule it to run and you have a (searchable) history.

 

-Kev

 

I'm listening Kev!

 

It pulls the IP address under the computer name, and the computer name under user name!!!

 

Also - i'm getting different results every time I run it - within seconds