[sims] Logging Users Off and Time Outs SIMS

[Grommit]

Hi

 

I read below that there are some ways of Booting users out of SIMS for patches and stuff..

We have SIMS installed on around 40 PC's in diffrent buildings around the site...

 

So the shotgun by the door isn't going to work :-)...

 

Also the users leave SIMS logged on.. all day and all night...

 

Is there a way of seeing who's on and what PC and booting them off ? ?

 

Also is there a time out for SIMS if the user leave a classroom with it logged on ?

[ajbritton]

If only! I think what's needed is some kind of webcam monitoring system which detects the user at logon and then auto logs off when that user is no longer appearing on the webcam for more than a few seconds. Other than that, some kind of physical token which has to be inserted in the computer....

 

OK, here's a thought...

 

1 - Get a cheapo USB key and put a file onto it which is recognizable. If you wanted to be posh, maybe you could make an MD5 hash of the users name combined with the volume name of the USB drive.

 

2 - Write an AutoIt script which checks for the presence of the file in the USB drive. (and verifies it if you went down the MD5 route)

 

3 - If the file is present, it launches SIMS.

 

4 - Using the AdLib function, the script can check for the presence of the file every 5 seconds or whatever.

 

5 - When the file is no longer present, the script can kill SIMS and/or log the user off.

 

Penalties for lost USB keys must be high for this to work however.

 

If this sounds like a workable system, then I might have a go at writing it...

 

EDIT: It occurs that this idea could be for the entire logon session...

[Grommit]

If only! I think what's needed is some kind of webcam monitoring system which detects the user at logon and then auto logs off when that user is no longer appearing on the webcam for more than a few seconds. Other than that, some kind of physical token which has to be inserted in the computer....

 

OK, here's a thought...

 

1 - Get a cheapo USB key and put a file onto it which is recognizable. If you wanted to be posh, maybe you could make an MD5 hash of the users name combined with the volume name of the USB drive.

 

2 - Write an AutoIt script which checks for the presence of the file in the USB drive. (and verifies it if you went down the MD5 route)

 

3 - If the file is present, it launches SIMS.

 

4 - Using the AdLib function, the script can check for the presence of the file every 5 seconds or whatever.

 

5 - When the file is no longer present, the script can kill SIMS and/or log the user off.

 

Penalties for lost USB keys must be high for this to work however.

 

If this sounds like a workable system, then I might have a go at writing it...

 

EDIT: It occurs that this idea could be for the entire logon session...

 

Rightttttt ...... So the shotgun it is then

[NetworkGeezer]

As Mr Britton says the situation is really bad. Version 7 programs i.e. (those accessed through the main SIMS.net GUI) only connect when they need to upload/download data. Therefore it's not possible to see if a SIMS session is still continuing or has finished. There session flags in the DB but their not visible with the availible tools.

 

The new version of System Manager was meant to add the ability to see who is on line. Unfortunately the release has delyed yet again to December. There is vague mention of "security enhancements" to be included.

 

One approach discussed on the support.net forum is to use an innocus generic patch which will of course scream if any one is still on. You can then use the list to pay a visit to the appropriate micreants.

 

As well any technological fix such as AJ's above, you also have to get SMT to impress on other colleagues that SIMS is maintained and kept upto date.

The October Main release, which was made availible on Wednesday, includes important new functionality for PLASC and Assessment Manager.

 

Either they want SIMS to work properly or they don't.

[ajbritton]

Rightttttt ...... So the shotgun it is then

 

ROFLMAO

[ChrisH]

I wrote a script a while ago to scan a list of machines to see if a sims process was running. That combined with pskill would be good.

I assume thigs have changed though and just looking for the launcher is not sufficient enough anymore?

[apeo]

You can actually find out who is logged on right now by using System Manager (i think) but it shows who sims think is still logged on ie the flag in the db hasnt be cleared yet (which it doesnt alway even if the user has closed sims). Any who heres how you do it, in System Manager bring up the user list, now click on the print icon and export it to a csv file. You will notice in there is a Logged_on column at the end.

[NetworkGeezer]

I wrote a script a while ago to scan a list of machines to see if a sims process was running. That combined with pskill would be good.

 

Doh! Why didn't I think of that.

 

I assume thigs have changed though and just looking for the launcher is not sufficient enough anymore?

 

Launcher! You have been away while. Welcome to the 21st centrury Mr. Powers

[apeo]

I wrote a script a while ago to scan a list of machines to see if a sims process was running. That combined with pskill would be good.

 

You wouldnt happen to have it still somewhere do you? Im rubbish at wmi programming but i can hack one from a template

[pete]

Announce the patch window well in advance, then run a script that forces a workstation reboot in 10 mins and then disables every domain account but yours? Bonus points for using setacl on the sims share so local users can't mess about.

 

That way they can't get back in until you let them.

[ChrisH]

When I said launcher I meant pulsar or whatever program it is

 

I will look for the script but it is hiding at the moment. I know I posted on our county board as well but I cant find it on there either I shall keep looking.

[ChrisH]

Ok I found it:

 

Has a nice reporting interface as well by the look of it .

 

I generated the workstation.txt every run by doing a net view > workstation.txt then cleaning it up in an editor. Quick and easy.

I havent tried it lately but should work ok. But havent tried since Jan 05

Will check what ever process you specify. Only big problem is if a machine has suddenly gone offline in the meantime it spends a while timing out on it.

 

'This script queries all the machines listed in machines.txt and finds if
'The process is input to teh textbox
'Primarily written to check if SIMS.net is running by looking for Pulsar.exe
'Author Chris Hindmarch Fishermore High School
'********************************************************************
'**********USE AT YOUR OWN RISK.*************************************
'**********USE AT YOUR OWN RISK.*************************************
'**********USE AT YOUR OWN RISK.*************************************
'********************************************************************

'Start Constant Declaration

Const For_Reading = 1
Const ForAppending = 8
Const Machine_List = "workstation.txt"'The text file that the machines are read from

On error resume next


'Start Variable declaration
Dim ArrMachineList()  'Holds the machine names
Set ObjFSO = CreateObject("Scripting.FileSystemObject")
Set ObjExplorer = CreateObject("InternetExplorer.Application")
SearchProcess = ""
StrComputer = ""
InputFile = ""
StrTemp = ""
i = 0

SearchProcess = InputBox ("Enter the process to search for" & VBCrlf & "Eg winword.exe"," Enter the process name")
Redim Preserve ArrMachineList(i)
Set InputFile = ObjFSO.OpenTextFile(Machine_List, For_Reading)
Do while InputFile.AtEndOfStream <> True
StrTemp = InputFile.ReadLine
ArrMachineList(i) = StrTemp
i = i + 1
Redim Preserve ArrMachineList(i)

Loop
i = 0

'*************************************************

ObjExplorer.Navigate "about:blank"
ObjExplorer.ToolBar = 0
ObjExplorer.StatusBar = 0
ObjExplorer.Width = 800
ObjExplorer.Height = 600
ObjExplorer.Left = 0
ObjExplorer.Top = 0
ObjExplorer.Visible = 1

Do While (ObjExplorer.Busy)
Loop

Set ObjDocument = ObjExplorer.Document
ObjDocument.Open
ObjDocument.Writeln "Process Status"
ObjDocument.Writeln ""
ObjDocument.Writeln "[b]Retrieving Process information. Please wait.......[/b]"
ObjDocument.Writeln "

[b]Currently searching for " & Search_Process & "[/b]"
ObjDocument.Writeln "</pre><table width="100%">"
ObjDocument.Writeln ""
ObjDocument.Writeln "[b]Station Name [/b]"
ObjDocument.Writeln "[b]Machine Status/Process Status[b]"
ObjDocument.Writeln ""

'*************************************************
For i = Lbound(ArrMachineList) to UBound(ArrMachineList) -1
StrComputer = ArrMachineList(i)
Set ObjWMIService = GetObject("winmgmts:" _
  & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
  If Err.Number <> 0 Then
       ObjDocument.Writeln ""
       ObjDocument.Writeln "" & StrComputer & ""
       ObjDocument.Writeln "" & Err.Description & ""
       ObjDocument.Writeln ""

          Err.Clear
      Else

  
Set ColProcesses = objWMIService.ExecQuery _
  ("SELECT * FROM Win32_Process WHERE Name = '"& SearchProcess &"' ")
If ColProcesses.Count = 0 Then
'Write to file stus active
  ObjDocument.Writeln ""
  ObjDocument.Writeln "" & StrComputer & ""
  ObjDocument.Writeln "" & "Application Inactive" & ""
  ObjDocument.Writeln ""
Else
      ObjDocument.Writeln ""
      ObjDocument.Writeln "" & StrComputer & ""
      ObjDocument.Writeln "" & "Application active" & ""
      ObjDocument.Writeln ""

End If
End If
Next ' For i = Lbound
ObjDocument.Writeln "</table>"<br>ObjDocument.Writeln "<br>[b]All Machines in the list processed[/b]"<br>ObjDocument.Writeln ""<br>Wscript.Sleep 4000<br>ObjDocument.Close<br>'ObjExplorer.Qui

[apeo]

Nice one, will have a look at it more closely later but at first glance it looks like it just spiders of and finds compy's running sims. It doesnt detect sims that has been idle for x period of time.. does it?

[ChrisH]

No just a simple process detection.

[Geoff]

You could perhaps check cpu usage of the sims process though if you wanted to get fancy.

[NetworkGeezer]

Doe activity really matter. The point is he has a patch/upgrade to put on and no one else should logged on.

[_Bob_]

So pull the network cable? Assuming you don't have to download updates as part of the process.

 

Alternatively WinExit.scr can be installed as a screensaver that kicks in after a GPO specified length of inactivity and logs the user off.

Its in the resource kit:

http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en

[nsherin]

What I normally do during a SIMS upgrade, as there is normally some twerp who hasn't read my note and logged off from SIMS is to simply drop the Subnet mask down to 255.255.255.0 before I start, - i.e. only in the subnet of our IP range where the servers are, as the SIMS box needs to be online to pull down updates via SOLUS. When the upgrade is done, I then reset the mask back.

 

This works a treat, rather than chasing around the school like a blue-arsed fly to see which idiot left themselves logged into SIMS. And more than often you can't get into all the Year Head Offices etc, as they are locked! Quick, simple and effective - as they can't access the server whilst the upgrade is underway.

[NetworkGeezer]

Surely that breaks one of the rules of Sys Admin: termination to controlled state.

 

If you just block connections during the upgrade (mask change or plug yank) you don't know what the clients were running at the time. Was someone completeing a register. Were they entering assessment grades or comments in end of term profile reports. Will these changes still be able to be saved after the update.

 

The October release adds changes to the Assessment Manager suite this may include database changes.

 

I suppose you can say you did warn them but just be careful that you don't introduce anomolies in to the databse by being too high handed.

[nsherin]

NetworkGeezer - I do hear what you're saying and you do have a point. The main people who use SIMS - our SIMS office always log out before I carry out the upgrade, so we don't run that risk. Same as our General/Finance office - they also log out a few minutes before the upgrade. The problem is year heads and others who leave their PCs left logged in - often not even locked, which is a security risk in itself - depsite my attempts to advise them!

[Gatt]

I get the same problem everytime a SIMS upgrade is applied

The LEA's SIMS team calls me up to say they need to apply the patch/update and they need everyone off SIMS

 

I send the appropriate email ("Log out of SIMS by hh:mm or DIE!") and yet they STILL just ignore it - tempted to kill the share to the "S-Drive" whilst it takes place..

[alonebfg]

could you not put a timed share on it ie set it so the share stops at midnight and then as soon as you do the update the following morning put it on or if you are going to pull the plug send a network msg giving the 5 mins so if they are doing something it gives them time and if someone logs in tells them not to try nothing

[skunk]

So no-one else just restarts the SQL database then?

 

Works a treat.

 

Skunk

[Toby.Belfield]

All,

 

In order to force all connections to be broken, you can run either the SOLUS wizard, or the DBUpgrade utility with the parameter /forceall. However - if there are people logged on, to log them off you will need the sa username and password (which can be passed as parameters /sauser= and /sapassword=)

 

Next year we are looking at modifying our upgrade processes so that it will not be necessary (in all cases) to force connections to be broken.

 

For the full list of parameters, run SOLUS from the command line - followed by /?

 

Regards,

 

Toby Belfield

Product Manager

Capita

[hasco3000]

As @skunk said, just restart the SQL Server service for the SIMS instance, this will boot everyone off of SIMS and you can run your patching/upgrades as you like.

 

Matt