Restrict Concurrent Logons using Domain Sessions?

[Nick_Parker]

Just an FYI : Getting a WSH vbscript to connect to MySQL is a mission in itself

 

Edit:

 

Turns out if you specify {MySQL ODBC 5.1 Driver } instead of {MySQL ODBC 3.51 Driver} it works better

Edited August 18, 2008 by Nick_Parker
I'm an idiot

[SYNACK]

OK, i'm sorry, this is probably going to sound really daft, but how would I go about doing that? I've never used GP to install stuff, I usually hold off till the next ghost image, but that could be a long way off for the time being.

I tried reading up on it, the one article says that it isn't actually installed until a user tries to use it, what would happen if a script tried to call it?

 

You should just be able to put the msi file into a share that everyone including computer accounts has access to. Then you simply make a new group policy in gpmc or AD Users and computers assigned to the OU that your computers are in. Under Computer Configuration in this new policy you want to expand the Software Settings container and the Software installation container.

 

Right click on the Software installation container and select New > Package

 

Now navigate to were you stored the MSI using network accassable UNC paths like \\server\dist$ and select the msi file.

 

Under the install method you want to use "Assigned" as that will install the program at startup for all users.

 

It depends on how the package is built as to how it behaves but it is most likely to just install the whole thing when using this method, if not you could use Orca to create a MST file that would force it to.

 

The install relys on group policy refreshing before a system reboot so it can take up to three reboots of a client to start deploying. You can speed this up by typing gpupdate /force at the command line of the client which will do it immediately.

 

If it did not install completely it will depend on the package advertising that it can provide teh ODBC provider, if it does then when the script is run it will trigger a full install silently.

Edited August 18, 2008 by SYNACK

[kesomir]

Perhaps when you have it working you could post a howto on the wiki - or on the forums with teh code

[Nick_Parker]

Perhaps when you have it working you could post a howto on the wiki - or on the forums with teh code

 

It would be my pleasure

[Nick_Parker]

Success

 

I have a working vbs script that creates sessions in a MySQL DB, then deletes the session when the user logs off. You just call the script and enter the relevant arguments:

 

example:

 

in your logon script:

 

WSHShell.Run "\\FileServer\NetLogon\NetworkSessions\NetworkSessions.vbs add " & objNetwork.username & " " & objNetwork.ComputerName & " " & strGroup, 0, TRUE

 

and in your logoff script:

 

WSHShell.Run "\\FileServer\NetLogon\NetworkSessions\NetworkSessions.vbs delete " & objNetwork.username & " " & objNetwork.ComputerName, 0, TRUE

 

I am doing a some testing on it over the next few days, writing a readme, tidying up the code a bit and POSSIBLY a PHP Backend and then I'll upload to edugeek if people are interested?

[SYNACK]

Success

 

I have a working vbs script that creates sessions in a MySQL DB, then deletes the session when the user logs off. You just call the script and enter the relevant arguments:

 

Sounds go, just an idea for the logic that you have probably implemented but it should be easy to add if not. If the machine has been hard powered off the record would still be in the DB.

 

You could add a few lines to the logic that removed the current user that did not log off properly by checking for the DB for any other users that were shown as being logged into that computer at logon and clear them. This way if the system just crashed they could simply log back on to the same machine then log off properly to unlock themselves.

 

This would also happen when someone else logged in which should clear up most locked sessions automatically. You could have it log when it cleared one of these sessions too incase you wanted to follow it up.

[ZeroHour]

just to say, it's easy to get around the .net drive restrictions. I for example, created a cert from the domain ca and signed the exe and deployed the .net security rules using the tool for macking a .net config msi.

[Nick_Parker]

Sounds go, just an idea for the logic that you have probably implemented but it should be easy to add if not. If the machine has been hard powered off the record would still be in the DB.

 

You could add a few lines to the logic that removed the current user that did not log off properly by checking for the DB for any other users that were shown as being logged into that computer at logon and clear them. This way if the system just crashed they could simply log back on to the same machine then log off properly to unlock themselves.

 

This would also happen when someone else logged in which should clear up most locked sessions automatically. You could have it log when it cleared one of these sessions too incase you wanted to follow it up.

 

I've got it set at the moment that if it tries to create a duplicate session, i.e. the user restarted their computer, it simply updates the logon time.

 

I'm in the process of writing something else which can be sheduled to run which will check that all sessions in the DB are still valid and remove them if not...

 

Ta for the suggestions, I'm looking for things to add/improve it!

[Nick_Parker]

just to say, it's easy to get around the .net drive restrictions. I for example, created a cert from the domain ca and signed the exe and deployed the .net security rules using the tool for macking a .net config msi.

 

Thanks ZeroHour, I'll look into it!

[kesomir]

I'm interested to see your script.

 

Does the final version rely on the odbc?

 

I'm in the process of writing something else which can be sheduled to run which will check that all sessions in the DB are still valid and remove them if not...

 

Easily done with a mysql query and cron to auto expire 'old' ones. To check to see if connections are active, could do by running a client side script?

[mac_shinobi]

Just to say that I would be interested in it once it is completed with regards to the wiki

ta

[ZeroHour]

Thanks ZeroHour, I'll look into it!

 

I cant remember the exact procedure as its at work but I will try and post some basics on monday.

[Nick_Parker]

To all those that are interested, attached is scripts I use to limit the network sessions at Dainfern College.

 

There is an SQL File to create the MySQL DB and Tables.

Sample logon script which shows how to call the main script and add a network session to the DB.

Sample Logoff script which shows how to call the main script and remove the network session from the DB.

AND the main script, NetworkSessions.VBS

 

It's quite a long winded script, but the idea being you could perform any network session/network user/Network User Groups related task with just the script.

 

The first paragraph within the NetworkSessions.vbs script shows the scripts usage.

 

The idea behind the user groups is that at our school I allow staff 2 sessions, one for their laptops and one for a lab machine whereas the students only get 1.

 

You can assign a specific user more additional sessions if needed (for example, my account has the standard 2 staff logons, plus another 8 additional).

 

When a user logs on, it deletes any sessions already existing for that computer name, means that any orphaned sessions get cleared the next time somebody uses that PC (in the case of a hard power off or crash) - this does cause a slight problem with servers/terminal services as the computer name remains the same for each session, although it hasn't been a big problem yet.

 

and pitfall no. 2 : It requires the MySQL ODBC Connector to be installed, although its quick and easy to do via GP settings as mentioned earlier in this thread (Thanks SYNACK)

 

Feel free to do what you wish with the code, it works for us the way it is

 

I've already started on the next version which will use a php backend for monitoring sessions etc so it doesn't need to be done via the command line.

 

Have fun and ta to everyone on the forum who helped

NetworkSessions.zip

[kesomir]

The Printer script on the wiki uses the clientname for terminal services sessions to get around that issue:

 

LCase(WshShell.ExpandEnvironmentStrings("%CLIENTNAME%")

 

You may need to identify your terminal servers and replace the client variable with this only for TS sessions, but you could do that with a switch and an array of the terminal server's computer names.

 

Just posted in case it becomes an issue for you in the future.

[Nick_Parker]

The Printer script on the wiki uses the clientname for terminal services sessions to get around that issue:

 

LCase(WshShell.ExpandEnvironmentStrings("%CLIENTNAME%")

 

You may need to identify your terminal servers and replace the client variable with this only for TS sessions, but you could do that with a switch and an array of the terminal server's computer names.

 

Just posted in case it becomes an issue for you in the future.

 

Thanks alot, I'll definately have a look

[Alis_Klar]

just to say, it's easy to get around the .net drive restrictions. I for example, created a cert from the domain ca and signed the exe and deployed the .net security rules using the tool for macking a .net config msi.

 

A quick google yielded ClickOnce Deployment and Authenticode is this how you did it?

[ZeroHour]

A quick google yielded ClickOnce Deployment and Authenticode is this how you did it?

 

Kinda, you need to use signtool to sign your exe (The shortcut should point to

"C:\Program Files\Microsoft Visual Studio 8\Common7\Tools\Bin\signtool.exe" signwizard

If you are using VS 2005)

I assume you run your own CA? Issue a cert to your own user account to allow you to sign (Run MMC->Add Certificates->My User Account->Right click on personal store->request cert)

Now you should sign your exe using the signtool as the signature will be needed later. To confirm its been signed you can right click->properties and check the "Digital Signatures" tab.

Now you need to install the full SDK for .net to get access to the settings easily (you have it if Microsoft .NET Framework 2.0 Configuration for example in admin tools).

Once in there goto:

Expand My Computer->Runtime Security Policy->Enterprise->Code Groups->All_Code then click "Add a Child Code Group"

Call it what ever you want really then click next then select "Publisher" as the condition. Next you want full trust then click finish.

Now edit the child code group you just made and switch to conditions tab. In there select "import from signed file" and then select your signed exe you just made. This signature will not change but expires once a year as its the default issue length CA's do so you will need to resign your exe and update .net again.

Once thats all in you should be ready to msi the code. You can deploy the modified enterprise file if you want but I just made a msi as it was simpler.

To make the MSI right click on "Runtime Security Policy"->Create Deployment Package and then it should make a nice msi to deploy that only rolls the new enterprise config out.

If you want you can make a permissions set if you must customise what the apps can do (replacing selecting "FullTrust" as the permissions in the wizard)

 

Good luck