Logon/Logoff Script to Audit Users

[thatley]

Hi,

 

I'm no scripter by all means, so wondering if any of you guys can clear this up for me please.

 

I have a batch file which outputs to a rolling log file, the following details (User name, Date/Time, Computer name and IP Address). I have one for logon and one for logoff and it works perfectly except the IP address only shows one connection on IPv4 not multiple connections (say for a laptop with LAN and wireless cards or PC with VM guest/s). The result I'm after is from the output of this command (ipconfig | findstr /i "ipv4") which shows all IPV4 connections, but I don't know how to incorporate that into my script. Here's the script i'm using:

 

@echo off & cls

 

Set "logFile=\\SERVERNAME\logs$\ %Computername%.txt"

 

::# Get IP Address

for /f "skip=1 tokens=2 delims=[]" %%* in (

'ping.exe -n 1 -4 %Computername%') Do (set "IP=%%*" & goto:exitFor1)

:exitFor1

 

::# Get Full Name of User

If /i "%USERDOMAIN%"=="%Computername%" (

for /f "skip=1 tokens=2,* delims= " %%a in (

'net.exe user "%Username%"') do (

(set "DisplayName=%%b" & goto:exitFor2))

) Else (

for /f "skip=3 tokens=2,* delims= " %%a in (

'net.exe user "%Username%" /domain') do (

(set "DisplayName=%%b" & goto:exitFor2))

)

:exitFor2

If defined DisplayName Set "DisplayName=%DisplayName:)=^)%"

 

::# Append to log

>>"%logFile%" (

echo\*** Logon

echo\User : %USERDOMAIN%\%Username% (%DisplayName%^)

echo\Date/Time : %date% - %time%

echo\To computer: %IP% (%Computername%^)

echo\-----------------------------------------------------------------)

 

It's the "GET IP ADDRESS" part that I need to change/remove/replace but don't know how.

 

Can anyone help with this? Or even have one doing the same thing, but in POWERSHELL?

 

Many thanks in advance.

Edited March 9, 2018 by thatley

[mrwoberts]

This might help...

 

setlocal EnableDelayedExpansion
for /f "tokens=2 delims=:" %%G in ('ipconfig ^| find "IPv4"') do (set IP=!IP!%%G)

[fordea]

I recommend checking this article out as it will show you an implementation of logon/logoff scripts by using Powershell and will also populate multiple log files based on user, computer and date: https://www.jasonpearce.com/2016/12/26/use-powershell-to-log-logon-and-logoff-activity-on-domain-computers/

In terms of adding an additional column for the IPv4 addresses into the script(s) in the article above you could add something like this before the lines containing 'Export-CSV' cmdlets:

$IPAddresses = (Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration | Where-Object {$_.IPAddress} | Select-Object -ExpandProperty IPAddress | Where-Object {$_ -notlike '*:*'}) -join ', '
$obj | Add-Member -MemberType NoteProperty -Name 'IPAddress' -Value $IPAddresses

[thatley]

This might help...

 

setlocal EnableDelayedExpansion
for /f "tokens=2 delims=:" %%G in ('ipconfig ^| find "IPv4"') do (set IP=!IP!%%G)

 

Thanks for the reply - can you tell me where this should go in my script and what to delete/amend?

[thatley]

I recommend checking this article out as it will show you an implementation of logon/logoff scripts by using Powershell and will also populate multiple log files based on user, computer and date: https://www.jasonpearce.com/2016/12/26/use-powershell-to-log-logon-and-logoff-activity-on-domain-computers/

In terms of adding an additional column for the IPv4 addresses into the script(s) in the article above you could add something like this before the lines containing 'Export-CSV' cmdlets:

$IPAddresses = (Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration | Where-Object {$_.IPAddress} | Select-Object -ExpandProperty IPAddress | Where-Object {$_ -notlike '*:*'}) -join ', '
$obj | Add-Member -MemberType NoteProperty -Name 'IPAddress' -Value $IPAddresses

 

Thanks for this, looks promising too

 

EDIT:

 

Just used your entry and the script from your link - works MINT! Thanks so much for this!!!

Edited March 9, 2018 by thatley

[thatley]

This might help...

 

setlocal EnableDelayedExpansion
for /f "tokens=2 delims=:" %%G in ('ipconfig ^| find "IPv4"') do (set IP=!IP!%%G)

 

Sorry was being thick!

 

Got this to work - you genius! Cheers buddy