Email when someone logs on?

[johnfermor]

Hi all

 

Does anyone know of a way to notify me when a certain user log-on?

 

Have a Windows network with Win 10 clients currently.

 

If not, would there be any interest in this if I roll my own? I envisage it would allow net admin to receive a notification when (selected) users login and the ability to send messages to them when they login.

 

John

Edited May 28, 2024 by johnfermor

[NicholasEsping]

Hi all

 

Does anyone know of a way to notify me when a certain user log-on?

 

Have a Windows network with Win 10 clients currently.

 

If not, would there be any interest in this if I roll my own? I envisage it would allow net admin to receive a notification when (selected) users login and the ability to send messages to them when they login.

 

John

 

You could make a scheduled task with a script that sends an email when a user logs in.

[dmj]

I know this is really easy to do in GSuite because it can share logs with Google Cloud, so you just set up an alert based upon any metric the logs sees.

For Window's I'd be inclined to use a similar method and get a notification on login to the domain controller if you are using one. What are you using to parse logs currently?

[johnfermor]

You mean parsing the event logs? I guess I could write a service that does that.

 

Would rather trigger something with a login script that way I can record station, and display any awaiting notifications as appropriate.

[johnfermor]

Maybe record each login to a database too?

[dmj]

You mean parsing the event logs? I guess I could write a service that does that.

 

Would rather trigger something with a login script that way I can record station, and display any awaiting notifications as appropriate.

 

That's how I would approach it, because it's more easily extensible to apply to monitor other things and more centrally managed - but if you need to display notifications to the user then a login script is probably the way forward.

[NicholasEsping]

You mean parsing the event logs? I guess I could write a service that does that.

 

Would rather trigger something with a login script that way I can record station, and display any awaiting notifications as appropriate.

If you use office 365 you could do something like this with PowerShell to send an email using Microsoft Graph API with the user logging in and workstation name.

[color=#CCCCCC][font=Consolas]
[color=#9cdcfe]$user[/color] [color=#d4d4d4]=[/color] [color=#dcdcaa]get-wmiobject[/color] [color=#d4d4d4]-[/color]Class Win32_Computersystem [color=#d4d4d4]|[/color] [color=#dcdcaa]select-object[/color] Username
[color=#9cdcfe]$workstation[/color] [color=#d4d4d4]=[/color] [color=#9cdcfe]$env:Computername[/color]

[color=#6a9955]#send email[/color]
[color=#9cdcfe]$AccessSecret[/color][color=#d4d4d4]=[/color] [color=#ce9178]""[/color]
[color=#9cdcfe]$AzureAppID[/color] [color=#d4d4d4]=[/color] [color=#ce9178]""[/color]
[color=#9cdcfe]$tenantID[/color][color=#d4d4d4]=[/color][color=#ce9178]""[/color]
[color=#9cdcfe]$tokenBody[/color] [color=#d4d4d4]=[/color] [color=#569cd6]@[/color]{
  [color=#9cdcfe]Grant_Type[/color]    [color=#d4d4d4]=[/color] [color=#ce9178]"client_credentials"[/color]
  [color=#9cdcfe]Scope[/color]         [color=#d4d4d4]=[/color] [color=#ce9178]"https://graph.microsoft.com/.default"[/color]
  [color=#9cdcfe]Client_Id[/color]     [color=#d4d4d4]=[/color] [color=#9cdcfe]$AzureAppID[/color]
  [color=#9cdcfe]Client_Secret[/color] [color=#d4d4d4]=[/color] [color=#9cdcfe]$AccessSecret[/color]
}
[color=#9cdcfe]$tokenResponse[/color] [color=#d4d4d4]=[/color] [color=#dcdcaa]Invoke-RestMethod[/color] [color=#9cdcfe]-[/color][color=#9cdcfe]Uri[/color] [color=#ce9178]"https://login.microsoftonline.com/[/color][color=#9cdcfe]$tenantID[/color][color=#ce9178]/oauth2/v2.0/token"[/color] [color=#9cdcfe]-[/color][color=#9cdcfe]Method[/color] POST [color=#9cdcfe]-[/color][color=#9cdcfe]Body[/color] [color=#9cdcfe]$tokenBody[/color]
[color=#9cdcfe]$headers[/color] [color=#d4d4d4]=[/color] [color=#569cd6]@[/color]{
  [color=#ce9178]"Authorization"[/color] [color=#d4d4d4]=[/color] [color=#ce9178]"Bearer [/color][color=#569cd6]$([/color][color=#9cdcfe]$tokenResponse[/color][color=#dcdcaa].[/color][color=#9cdcfe]access_token[/color][color=#569cd6])[/color][color=#ce9178]"[/color]
  [color=#ce9178]"Content-type"[/color] [color=#d4d4d4]=[/color] [color=#ce9178]"application/json"[/color]
}

[color=#9cdcfe]$MailFrom[/color] [color=#d4d4d4]=[/color] [color=#ce9178]"[email protected]"[/color]
[color=#9cdcfe]$MailTo[/color] [color=#d4d4d4]=[/color] [color=#ce9178]"[email protected]"[/color]
[color=#9cdcfe]$URLsend[/color] [color=#d4d4d4]=[/color] [color=#ce9178]"https://graph.microsoft.com/v1.0/users/[/color][color=#9cdcfe]$MailFrom[/color][color=#ce9178]/sendMail"[/color]
[color=#9cdcfe]$BodyJsonsend[/color] [color=#d4d4d4]=[/color] [color=#ce9178]@"[/color]
[color=#ce9178]{[/color]
[color=#ce9178]   "message": {[/color]
[color=#ce9178]   "[/color][color=#9cdcfe]$user[/color][color=#ce9178] has logged in to [/color][color=#9cdcfe]$workstation[/color][color=#ce9178]"[/color]
[color=#ce9178]   },[/color]
[color=#ce9178]   "toRecipients": [[/color]
[color=#ce9178]      {[/color]
[color=#ce9178]      "emailAddress": {[/color]
[color=#ce9178]      "address": "[/color][color=#9cdcfe]$mailto[/color][color=#ce9178]"[/color]
[color=#ce9178]          }[/color]
[color=#ce9178]      }[/color]
[color=#ce9178]   ][/color]
[color=#ce9178]   },[/color]
[color=#ce9178]   "saveToSentItems": "true"[/color]
[color=#ce9178]}[/color]
[color=#ce9178]"@[/color]
[/font][/color]
[color=#DCDCAA][font=Consolas]Invoke-RestMethod[/font][/color][color=#9CDCFE][font=Consolas]-[/font][/color][color=#9CDCFE][font=Consolas]Method[/font][/color][color=#CCCCCC][font=Consolas] POST [/font][/color][color=#9CDCFE][font=Consolas]-[/font][/color][color=#9CDCFE][font=Consolas]Uri[/font][/color][color=#9CDCFE][font=Consolas]$URLsend[/font][/color][color=#9CDCFE][font=Consolas]-[/font][/color][color=#9CDCFE][font=Consolas]Headers[/font][/color][color=#9CDCFE][font=Consolas]$headers[/font][/color][color=#9CDCFE][font=Consolas]-[/font][/color][color=#9CDCFE][font=Consolas]Body[/font][/color][color=#9CDCFE][font=Consolas]$BodyJsonsend[/font][/color]

[slugshead]

We use ADaudit+ from Manage Engine, it can certainly do this and has come in clutch countless times

[timbo343]

We use UserLock - not free but certainly worth it's value.

[johnfermor]

What sort of cost is Userlock?

 

Have just been on their website and they've buried the 'pricing' tab. Also, they require an email enquiry for cost information. I just want a ballpark so I'm not wasting any ones time if it's £000's.

 

I can't work with companies that work like this.

Edited May 30, 2024 by johnfermor

[timbo343]

What sort of cost is Userlock?

 

Have just been on their website and they've buried the 'pricing' tab. Also, they require an email enquiry for cost information. I just want a ballpark so I'm not wasting any ones time if it's £000's.

 

I can't work with companies that work like this.

I can't remember what the pricing was, ping over an email to one of their UK distributors - https://www.isdecisions.com/purchase/resellers.htm

 

As it's agent based, you need to give cost for number of machines the agent will be sat on.

 

We bought our license a few years ago and still on V11 but bought the licenses out right.

 

Userlock will also do MFA for windows logons.

 

There is a userlock rep on here called Mel - https://www.edugeek.net/showthread.php?t=211336

Edited May 30, 2024 by timbo343