Student 'Tracking'

[SYNACK]

Logging 'failed' logins (bad passwords, too many concurrent logins, time/workstation restrictions) would be helpful too.

 

To implement this the easiest way would be to use a chunk of WMI code that stripped out the relevant events from the event logs on each of the domain controllers and chuckes them in a database.

 

It may actually be a nice clean way to handle that part of it as the event should give you username, station name and time at least.

 

This little chunk of code will actually monitor the event log in real time which should provide the functionality:

http://www.microsoft.com/technet/scriptcenter/resources/qanda/feb07/hey0226.mspx

Edited May 2, 2008 by SYNACK
Code example