Script to track user logins

[Gatt]

I'm looking for a script that will track the following info to a text or DB file when users login and again when they logout:

 

Date & Time

Username

Event (Login / Logoff)

PC Name

IP Address

 

Anyone able to help me out on this?

[webman]

already been done

[ChrisH]

already been done

 

Beat me to it :? You can also modify some of the scipts in this post for a flat file.

[Gatt]

Excellent - thanks guys

I did search but obviously not that well!!

[spc-rocket]

Hi Guys,

 

Here's few scripts that were posted in the communities forum (RM). They have a logon and logoff script which basically records the user's logon and logoff information.

 

You need to modify the location of the access database and have i believ write permission on the db.

 

There is a help file (PDF) which tells you how to use and set it up. I found it it to be really useful and very easy to setup.

 

 

Ashok.

logonrecorder.zip

[Uraken]

has any one done any work on the database on this i want to interegate it will tell me what machine a user is at . i can do it by searching but its a bit long winded, (hark at me that knows nothing about access at all!) this is a really good app by the way.

thanks in advance

[StewartKnight]

you don't need a script, Server logs in 2003 can be made to collect that information

[Uraken]

spill the beans then mate stewart ....

[NetworkGeezer]

The problem with these solutions is that they involve scripts running in the security context of the user.

 

This is means that a student could find the log/semaphore file and just delete it

 

@Stewart

Yes apart from the IP address, the server security log records all the items Gatt has requested. The problem is that it only does if for access to that server which may be fine use only one DC or only one file server. if you have DFS and DC load balancing in place then you have to search across all you servers to build up a complete record.

[mattx]

Make a dir on the local pc called c:\logs [ you can edit this script to do so if you wish ] Compile the script and run it at logon. It will show this in the txt file and will add a new line everytime a user logs on:

On 2007-01-24 18:30:30 : User: MattX Logged On To PC: MATTDELL, IP Address: 192.168.1.102

 

AutoIT script:

 

; AutoIt Version: 3.10

; Language: English

; Platform: WinXP

; Author: Matt Marsh

; Script Function: Script that records logon details in log file

; Date: Oct 2005

 

 

Dim $sLogPath = "c:\logs\logger.txt"

Dim $sLogMsg = "User: "

_FileWriteLog($sLogPath, $sLogMsg)

 

Func _FileWriteLog($sLogPath, $sLogMsg)

 

Local $sDateNow

Local $sTimeNow

Local $sMsg

Local $hOpenFile

Local $hWriteFile

Local $user

Local $cname

Local $ip

 

$sDateNow = "On " & @YEAR & "-" & @MON & "-" & @MDAY

$sTimeNow = @HOUR & ":" & @MIN & ":" & @SEC

$user = @UserName

$cname = @ComputerName

$ip = @IPAddress1

 

$sMsg = $sDateNow & " " & $sTimeNow & " : " & $sLogMsg & $user & " Logged On To PC: " & $cname & "," & " IP Address: " & $ip

 

$hOpenFile = FileOpen($sLogPath, 1)

 

If $hOpenFile = -1 Then

SetError(1)

Return 0

EndIf

 

$hWriteFile = FileWriteLine($hOpenFile, $sMsg)

 

If $hWriteFile = -1 Then

SetError(2)

Return 0

EndIf

 

FileClose($hOpenFile)

Return 1

EndFunc

[NetworkGeezer]

Huge problem Matt. The logs would be stored on each PC. There's still the problem of the script/EXE running in the student security context.

 

What is need is an RPC based client/server solution (did I get the words right Geoff? )

[mattx]

Why is it a huge problem ? Just re-direct the TXT file to a share or the users profile.

Control the EXE with a policy if you are worried about security...

RPC based client / server solution ? OVERKILL for such a simple task. Why make this complex when it does not have to be.

Keep it simple - always been my motto. The script is not there to be used as is, it may offer a solution or a work around which they can adjust to their own requirements. Each network / school is different - I only posted it as a solution to how I log things on our network.

[CyberNerd]

alternate:

install a syslog client on your DC's and have them send the eventvwr message to a centralised mysql database. Search the database with phpsyslogng

 

http://www.phpwizardry.com/php-syslog-ng.php

[Uraken]

whoah hang on did i miss something??rpc?security contexts? the logon recorder scripts and database provided work very well (fantastically well even) my problem is that i want to query the database so that i can ask it who is sat at what machine at any given time but i don't do access any body out there done anything with this?

[CyberNerd]

Clearly it can be done securely

My suggestion was to redirect (ssl) the windows eventvwr logs to another (secured database) server so it can be easily searched through an (ssl enabled) browser (with a password) - this way if your DC gets rooted or dies - you still get to see the last event - arguably more secure, and centralised for easy searching by admin. why not do it to all servers - you get print stats and all sorts in one place.

 

http://www.intersectalliance.com/projects/index.html

[mattx]

Like I said, it depends on your network requirements, we don't need to pull off stats for printing and such and certainly don't need to build a database with the information in. Some schools may - for what purpose I have no idea.

Yes Yes you can view these stats in the event viewer, but if I am sitting at a PC and what a quick view I just open up the txt file my script wrote.

Thats why I offered it, security is not a problem - [ with the script running and loggin on the c: drive - which is being held in a policy - Stations ---> Computer Config ---> Security Settings ---> File system] , the logs being held on the local pc is not my problem on my network as thats how I wrote the script to intend to work, ON OUR NETWORK.

The original poster may like your solution, he may like mine - who knows ? As long as he gets some ideas as to how he is going to solve his requirements - thats what counts.

[Geoff]

security is not my problem

 

Oh dear. You should never take this attitude. You should always strive to be reasonably secure in whatever your setting up. Yes there's usability and cost implications to balance but it's worthwhile in the long run.

[mattx]

You have taken that statement out of context Geoff, maybe I should have worded it better - security is not my problem with this script I wrote which allows write access to the C: drive of a folder - [ which is controlled through a policy anyway... ]

[Gatt]

@Uraken - I'm with you on that one.. I got mine going to a PHP/MySQL DB, but need to add options on how to query who sat where & when

Also need a way of trapping the IP address..

[Geoff]

security is not my problem with this script I wrote which allows write access to the C: drive of a folder

 

Yes it is, consider the following questions:

 

1) What happens if the hard drive fails?

2) What happens if the PC is stolen?

2) How can you backup these audit logs?

3) How can you limit the length of time these logs are kept?

 

Now these points only cover data security issues. There's probably plenty more I can think of.

[mattx]

Geoff - I think your nit picking and generally being a pratt now.

[yeoman]

Take a look at FWNUA http://fwnua.sourceforge.net/ it might be of use.

[Geoff]

Geoff - I think your nit picking and generally being a pratt now.

 

Wikipedia to the rescue.

 

http://en.wikipedia.org/wiki/Ad_hominem

[mattx]

Wikipedia to the rescue.

 

I think someone needs to come to your rescue Geoff.

 

Someone wanted some advice on logging details etc, people including myself offered solutions and ideas and you seem intent on just knocking them for it or finding holes.

[Geoff]

Someone wanted some advice on logging details etc, people including myself offered solutions and ideas and you seem intent on just knocking them for it or finding holes.

 

Sorry, but the thread does not reflect your version of reality if you review it in full.

 

NetworkGeezer first raised the issue of security:

 

The problem with these solutions is that they involve scripts running in the security context of the user.

 

This is means that a student could find the log/semaphore file and just delete it

 

This viewpoint was backed up by further posts by NetworkGeezer, Cybernerd any myself. I even took the trouble to cite some example scenarios where your specific solution will lead to undesirable outcomes.

 

How is a DPA breach 'nit picking'?