Logging student PC use

[robjduk]

Afternoon all,

Is there a simple way to log how many times a computer is logged in to and put have the data put into a nice spreadsheet? I have a few departments who I know do not use half their computers but of course, I need data to back this up.

 

I don't need to know who has used it, just actual logins.

 

Thanks all

[LeMarchand]

We have a GPO + a script that runs on log on/off. Not 100% accurate, but should give you a good idea.

 

Off to dig it up.

[MartinByard]

Simple suggestion, during the login script (if you use one) run a function that outputs to a csv with date and time, IP address, environment variables .. etc...

 

For example:

Function Get-AuditData
{
 "$env:computername" +", + (gwmi win32_networkadapterconfiguration | ?{$_.DHCPEnabled -eq $True -and $_.IPAddress -like "10.*"}).IPAddress +","+ (Get-Date -format dd/MM/yyyy) +","+ (Get-Date -format HH:mm:ss) +","+ "$env:username" +","+ "Audited" +","+ "$env:userdomain" + "," + $env:sessionname | out-file \\Server\Share\Filename.csv -Encoding ASCII -Append
}

[sister_annex]

I created this vbs a while back, it creates a log file (or csv if you wish) in a share for each username and computer that is accessed each time a user logs on. It just needs calling from your logon script. It may be callable via gpo however I've never done this so can't guarantee it would work as expected. The shares in question will need to be writable by everyone to allow files to be created.

 

LogonTracker.txt

[LeMarchand]

set mytime=%TIME:~0,-3%

echo LogOn,%COMPUTERNAME%,%USERNAME%,%DATE%,%mytime%,%version% >> \\SuitablyPermissionedShare\UsageLog.csv

exit

 

Just change LogOn to LogOff for that script. We call them via GPO at logon/off.

 

Thanks to @sted for the %mytime% variable idea back in 2017 - I feel old!

[kennysarmy]

Add this to your logon script:

 

echo %date%,%time%,%username%,%computername%,%logonserver% >> \\\logonlist.csv

[mavhc]

Other option is to use centralised event logging to gather logon events from all the computers, then parse it in one place

[psynegy]

Other option is to use centralised event logging to gather logon events from all the computers, then parse it in one place

Any recommendations for centralised log parsing? I know NCSC was pushing LME, but they've deprecated that now. Anything else floating peoples boats without costing a small fortune?

[jthompson]

Add this to your logon script:

 

echo %date%,%time%,%username%,%computername%,%logonserver% >> \\\logonlist.csv

 

I don't have a suggestion for centralised logging, but I just want to add that we do pretty much the same as above, but we also include the string "LOGIN" in that line. We then have an equivalent "LOGOFF" line in a logoff script.

 

The files that we write out to are %computername%.log and %username%.log, which makes the log files a bit easier to use.