What do you use to monitor user logins?

[Tom_P]

Hello!

 

As the title suggests; what do you use to monitor what users are logged into which workstation?

 

I use to work for RM and the only thing I miss was the ability to view all the computers and users and see where a user is logged in and visa versa in the management console.

 

I was wondering how you guys retrieve this information so i can implement something new to make our lives easier.

 

Many thanks.

Tom

[KevinB]

Impero all the way! Not cheap but a godsend of a tool.

[IrritableTech]

Netsupport DNA. So handy.

[LeMarchand]

A logon/off script that writes to a file. Not 100% accurate or as fancy as other methods, but it's free.

[DavR]

A login script that writes to a shared folder. It creates a text file for each workstation, telling me who was the last person to log on to that device.

 

Doesn't give you history or a nice spreadsheet or whatever, but it tells me who the last person to log on to a laptop was when it goes missing, which was all I wanted at the time.

[Jawloms]

Impero, but also a logon script which updates the computer's "Description" field with username, date and time so it all appears in AD.

[LeMarchand]

a logon script which updates the computer's "Description" field with username, date and time so it all appears in AD.

 

Oooh! That sounds cool!

 

Is it shareable?

[Jawloms]

Save it as a .vbs

 

Set WshNetwork = WScript.CreateObject("WScript.Network")
Set objWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")

' Get computer object in AD
Set objSysInfo = CreateObject("ADSystemInfo")
Set objComputer = GetObject("LDAP://" & objSysInfo.ComputerName)

' Build up description field data and save into computer object if different from current description
' We also do not update computers with a description that starts with an underscore (_)
newDescription = WshNetwork.UserName & " @ " & FormatDateTime(Now)
if not objComputer.Description = newDescription and not left(objComputer.Description,1) = "_"  then
 objComputer.Description = newDescription
 objComputer.SetInfo
end if

 

I sometimes use it to find out where someone is. If you search AD for all computers, then sort them by the "Description" field, you can find the username easily because they are obviously now in alphabetical order, and see which computer they are logged in to.

 

I cannot take credit for this script, but honestly can't remember who to give credit to! I probably got it from EduGeek!

[jthompson]

A logon/off script that writes to a file. Not 100% accurate or as fancy as other methods, but it's free.

 

Same here. Our logon and logoff scripts write to 2 files: username.log and computername.log. That provides a simple way to look at the login history for a particular user or for a particular computer.

[Jawloms]

Save it as a .vbs

 

Set WshNetwork = WScript.CreateObject("WScript.Network")
Set objWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")

' Get computer object in AD
Set objSysInfo = CreateObject("ADSystemInfo")
Set objComputer = GetObject("LDAP://" & objSysInfo.ComputerName)

' Build up description field data and save into computer object if different from current description
' We also do not update computers with a description that starts with an underscore (_)
newDescription = WshNetwork.UserName & " @ " & FormatDateTime(Now)
if not objComputer.Description = newDescription and not left(objComputer.Description,1) = "_"  then
 objComputer.Description = newDescription
 objComputer.SetInfo
end if

 

I sometimes use it to find out where someone is. If you search AD for all computers, then sort them by the "Description" field, you can find the username easily because they are obviously now in alphabetical order, and see which computer they are logged in to.

 

I cannot take credit for this script, but honestly can't remember who to give credit to! I probably got it from EduGeek!

 

Sorry, I've just had a thought so did a quick Google, you also need to do this so that the users have "write" access to the description field.

 

Open Active Directors Users and Computers MMC

Right click on your domain, and select ‘properties’ from the context menu

On the ‘security’ tab, click the ‘advanced’ button

Click the ‘add’ button, type ‘Authenticated Users’. Then click OK.

In the permission > properties > dialogue, set the ‘apply to’ pull-down menu to ‘Descendant Computer Objects’, allow the option for ‘Write Description’

[ITGURU]

A logon/off script that writes to a file. Not 100% accurate or as fancy as other methods, but it's free.

Same here - free logon script. tracks user / computer / server logins so can cross reference

where a user has logged on

what users have logged into a particular machine

[Chaniel]

I use a logon/logoff script which writes to a SQL Database, find it's a lot quicker and more reliable than accessing Impero logs.

 

I then just use a powershell script to filter that DB to a username or computer name.

[Tom_P]

These are great thanks guys!

 

I have set up a logon script which is working a treat.

 

But im also working on getting the school to sign off an order for Impero. Fingers crossed!

[WannabrewUK]

I use a logon/logoff script which writes to a SQL Database, find it's a lot quicker and more reliable than accessing Impero logs.

 

I then just use a powershell script to filter that DB to a username or computer name.

 

Hi would you be willing to share this? It's exactly what I'm looking for.

 

Thanks

[caffrey]

I have a similar logon \ off script, bonus feature is that it allows the students to only log onto one machine at a time

[CyBeRkId2002]

Log-on script to text file for us! One script that writes to one text file for all logons within a school for easy searching when needed! It has been 100% effective and code is below:

 

echo %date% %time% %computername% %username% >>"\\server\Share\Folder\logs\logons.txt"

[JJonas]

Our modified version of the above works quite well

 

echo %date% %time% %computername% %username% >>\\server\logon$\logons.txt

echo %date% %time% %computername% >> \\server\logon$\users\%username%.txt

echo %date% %time% %username% >> \\server\logon$\computers\%computername%.txt

Edited May 28, 2021 by JJonas

[jthompson]

Log-on script to text file for us! One script that writes to one text file for all logons within a school for easy searching when needed! It has been 100% effective and code is below:

 

echo %date% %time% %computername% %username% >>"\\server\Share\Folder\logs\logons.txt"

 

Do you also have a corresponding logoff script? Recording where/when those happen (or not!) can often provide really helpful context.

[markberry]

We use ABTutor. Doesn't have all the functionality of Impero but much cheaper and does everything we need it to. You can buy a perpetual license too so no ongoing 'subscription' costs.

[webman]

Hi! When I worked in a school, I built something called LoginTracker to do this (a long time ago!)

 

It used VBScripts at logon/logoff to report the event + data to a small web service, written in PHP and using a MySQL database. It had a page to view and search for logged-in users and computers, and could be used to restrict users to maximum of one login at a time.

 

The code is still online if anyone felt like they wanted a challenge to update it for their own needs / build a new version: github.com/craigrodway/logintracker.

[free780]

Fortinet FSSO or SCCM will show user but not designed for shared devices so can lag.

[ITGuyWestMidlands]

If your Windows devices are hybrid Azure joined then sign ins will appear in the Azure audit logs

[Roberto]

Sorry, I've just had a thought so did a quick Google, you also need to do this so that the users have "write" access to the description field.

 

Open Active Directors Users and Computers MMC

Right click on your domain, and select ‘properties’ from the context menu

On the ‘security’ tab, click the ‘advanced’ button

Click the ‘add’ button, type ‘Authenticated Users’. Then click OK.

In the permission > properties > dialogue, set the ‘apply to’ pull-down menu to ‘Descendant Computer Objects’, allow the option for ‘Write Description’

 

 

This allows users write access to that field on every single computer object? Including servers and other objects that masquerade as compute account objects. A mischievous student could have a lot of fun with this. If you must use this hack, I’d strongly suggest you apply this change to specific workstation OUs, not the whole domain.

Edited June 2, 2021 by Roberto