Stop Pupils Sharing their logins!

[ssiruuk2]

We use Userlock - really like it.. ontop of restricting the kids to 1 login; a while back we strongly suspected that a staff account had been compromised and via userlock had it set to email me as soon as this member of staff signed in anywhere.. needless to say the student was caught red handed whilst sat there looking at "applying personal settings" waiting for the staff desktop to appear

 

But yes I do wonder why this isn't something that is just integrated into windows server / AD.

[FAA]

But yes I do wonder why this isn't something that is just integrated into windows server / AD.

 

You will find detailed information in our whitepaper titled "8 Holes in Windows Login Controls"

[cookie_monster]

Is it really such a big problem?

 

We just pick them up as and when it's a problem, we track users using an access Db so we can tell if someone was logged on in more than one location we can then cross reference this on the IP cameras. It's not something that we see as a big issue.

[ricki]

Hi

 

I have written up what I can remember but you need to test this

 

Create a folder on a server and set the NTFS permissions so students can write to it.

Share the folder so students have full control

Create a muliuserlogon.bat and put the following in

title Check if user loged in


echo Checking to see if folder exists


if not exist "\\server\share\%username%" goto logoff

:logon
echo Make directory
mdir "\\server\share\%username%"
goto End

:logoff
echo Logging off
shutdown -l

:End

 

Create a multiuserlogoff.bat and put the following in it

 

echo Remove folder
rd "\\server\share\%username%" /s /q

 

Now copy a testuser to a new ou for testing

DO NOT USER ON ADMINISTRATORS AND MANAGER ACCOUNTS

create a gpo and link to the test user ou

link the log on and log off scripts in the gpo for the test user

 

Now run a gpupdate /force /boot on a client machine.

 

Log the test user on and check they can log on ok.

 

Check the file is created in the share.

 

You can also see the students who are logged in at any time once it is implemented,

 

Then try to log the test user onto another computer and it should log off because it finds the folder created by the first account logon.

 

Log the first test user off and it should delete the folder. You need to check this.

 

Now try logging on again with the second machine.

 

If a machine crashes you might have to delete the folder manually.

 

I also think a script was run over night to clear any folders left in the share as a just in case.

 

Please test this carefully before making it live as I am working from memory and the scipts are not tested.

[FAA]

Is it really such a big problem?

 

IMHO, not implementing efficient login session controls in an educational organization might cause serious problems. Think of these situations for example:

 

- It’s very easy for students to disclose their credentials to unauthorized third parties as there is no consequence on their own access to the network.

Thus, several workstations can unduly be blocked by one user and serious security flaws can occur (e.g.: server attacks).

 

- A student/pupil having managed to get a teacher’s credentials will be able to access confidential information (exam questions, results, etc…) from any workstation on the network.

 

- In the event of abnormal or suspicious behavior having been detected on a workstation, Windows native features will not allow the administrator to remotely disconnect the user or lock the session from a central console or any online computer

 

- If a student/pupil leaves his session open or locked, the workstation is unavailable to all other students/pupils willing to login with their own account.

[cookie_monster]

IMHO, not implementing efficient login session controls in an educational organization might cause serious problems. Think of these situations for example:

 

- It’s very easy for students to disclose their credentials to unauthorized third parties as there is no consequence on their own access to the network.

Thus, several workstations can unduly be blocked by one user and serious security flaws can occur (e.g.: server attacks).

 

- A student/pupil having managed to get a teacher’s credentials will be able to access confidential information (exam questions, results, etc…) from any workstation on the network.

 

- In the event of abnormal or suspicious behavior having been detected on a workstation, Windows native features will not allow the administrator to remotely disconnect the user or lock the session from a central console or any online computer

 

- If a student/pupil leaves his session open or locked, the workstation is unavailable to all other students/pupils willing to login with their own account.

 

 

We make 'their' logon 'their' responsability in the AUP that they and their parents sign, if they disclose this and there are issues they are directly responsible and punished accordingly.

 

How does limiting multiple sessions prevent a student gaining access to a staff password and logging on as the member of staff? This would only prevent them logging on at the same time as the member of staff which doesn't solve the issue of the student knowing the password.

 

You can use Gencontrol or VNC to log off a remote user both are GPL and free, most schools us a remote control app e.g. NetSupport anyway.

 

We don't allow students to lock their station as they only use shared terminals so this isn't an issue.

Edited March 18, 2010 by cookie_monster

[6Foot2]

We did it this way for free

 

Prevent Multiple Logons With GPOs

 

I have set this up here.

 

It didn't take long at all. I made a few modifications [by separating the users and the computers text files I can see who is logged on now. I also added three other text files: Historical Logons, Historical Logoffs and Duplicate logon attempts. These three files all record the day/time/workstation where the logon request originated. All works like a dream.]

 

Thanks given.

[cookie_monster]

I have set this up here.

 

It didn't take long at all. I made a few modifications [by separating the users and the computers text files I can see who is logged on now. I also added three other text files: Historical Logons, Historical Logoffs and Duplicate logon attempts. These three files all record the day/time/workstation where the logon request originated. All works like a dream.]

 

Thanks given.

 

 

 

What happens if a station crashes and the logoff script doesn't run?

[6Foot2]

What happens if a station crashes and the logoff script doesn't run?

 

I am still working on that one. At the moment I am willing to delete the files that have been created which prevent the students logging on after a crash.

 

Longer term if the script doesn't run I will...

 

... get back to you on that one.

[cookie_monster]

I am still working on that one. At the moment I am willing to delete the files that have been created which prevent the students logging on after a crash.

 

Longer term if the script doesn't run I will...

 

... get back to you on that one.

 

 

 

Same problem I’ve had with similar solutions then, let us know how you get on cheers.

[FAA]

How does limiting multiple sessions prevent a student gaining access to a staff password and logging on as the member of staff? This would only prevent them logging on at the same time as the member of staff which doesn't solve the issue of the student knowing the password.

 

You have a point here, as I did not think of limiting concurrent logins but of implementing workstation restrictions.

 

UserLock indeed allows user group's network access restriction per workstation or IP range. Thus, a student/pupil will not be able to login using a teacher’s credentials from a room equipped with free access workstations.

[cookie_monster]

You have a point here, as I did not think of limiting concurrent logins but of implementing workstation restrictions.

 

UserLock indeed allows user group's network access restriction per workstation or IP range. Thus, a student/pupil will not be able to login using a teacher’s credentials from a room equipped with free access workstations.

 

 

 

What if a teacher want's to log on to the machine? Our staff frequently use class PC's.

[FAA]

What if a teacher want's to log on to the machine? Our staff frequently use class PC's.

 

Well, you can't have your cake and eat it ...

 

More seriously, in this case you might want to:

 

1) restrict students to only login from classroom computers

 

2) not to set workstation restrictions for teachers (or at least not restricting them for log on from classroom PCs)

 

3) educate your teachers to carefully check the UserLock warning message.

 

UserLock indeed allows notifying all users prior to gaining access to a system with a tailor-made warning message.

These messages can for example include:

- a tailor-made legal disclaimer or AUP

- last workstation logged on

- date and time of last successful logon

- history of all logons denied by UserLock and Windows since last successful logon

- number of logons denied by UserLock and Windows since last successful logon

 

This is one of the most effective ways to detect people impersonating other user accounts, providing your teachers are reasonably security aware.

[cookie_monster]

Well, you can't have your cake and eat it ...

 

More seriously, in this case you might want to:

 

1) restrict students to only login from classroom computers

 

2) not to set workstation restrictions for teachers (or at least not restricting them for log on from classroom PCs)

 

3) educate your teachers to carefully check the UserLock warning message.

 

UserLock indeed allows notifying all users prior to gaining access to a system with a tailor-made warning message.

These messages can for example include:

- a tailor-made legal disclaimer or AUP

- last workstation logged on

- date and time of last successful logon

- history of all logons denied by UserLock and Windows since last successful logon

- number of logons denied by UserLock and Windows since last successful logon

 

This is one of the most effective ways to detect people impersonating other user accounts, providing your teachers are reasonably security aware.

 

 

 

The features look ok but I'm not sure that it's anything that can't be achieved for free and in conjunction with a good password policy and staff training i.e training them to take care when entering their password, we also have a good password policy that forces them to change it frequently.

I'm sure some schools have that kind of money but I couldn't justify the cost myself, we don't have enough PC's to be restricting them to either staff or students (except for office PC's of course)

 

Thanks.

[Kipling]

I am still working on that one. At the moment I am willing to delete the files that have been created which prevent the students logging on after a crash.

 

Longer term if the script doesn't run I will...

 

... get back to you on that one.

 

I had a stab at limiting logon sessions last half term and fixed the problem of crashed PCs leaving orphaned files behind (using a third script). I put the idea on the back burner and didn’t end up using it (fully) so it hasn’t be thoroughly tested in anger.

 

It’s not based on those scripts but pretty much the same concept; I’ll tidy them up a bit and post them tomorrow if I get half an hour.

[localzuk]

How about some form of service which periodically checks for a logged on user, sending this to an MSSQL database when someone logs on, then just have the services also check the server when someone tries to log on, looking for logins within a certain time frame - if one exists, they're still logged in elsewhere (the service could also include functionality to force log off the other logged in account), if not, they can log in.

 

Thoughts?

[6Foot2]

How about some form of service which periodically checks for a logged on user, sending this to an MSSQL database when someone logs on, then just have the services also check the server when someone tries to log on, looking for logins within a certain time frame - if one exists, they're still logged in elsewhere (the service could also include functionality to force log off the other logged in account), if not, they can log in.

 

Thoughts?

 

My thoughts are 'That sounds like a plan!'

 

However I am not a programer.

 

It would be great if we could deploy this as a server only based solution to speed up deployment/re-deployment. Would that be an option?

 

Edit: I have noticed that the scripts are, of course, dependant upon DNS to correctly identify the station the user is logged onto. I have seen some stations mis-identified in the logs today. I will have to tackle my DHCP/DNS issues but is there a way of picking up the station name from the station locally [the station the user is logging onto] rather than have the script ask DNS for a name resolution? [Only my servers and printers have static IPs]

Edited March 18, 2010 by 6Foot2
Add deatil to the post.

[Kipling]

How about some form of service which periodically checks for a logged on user, sending this to an MSSQL database when someone logs on, then just have the services also check the server when someone tries to log on, looking for logins within a certain time frame - if one exists, they're still logged in elsewhere (the service could also include functionality to force log off the other logged in account), if not, they can log in.

 

Thoughts?

 

In a sense that’s what my third script does; it checks periodically that the records are a true reflection of who is actually logged on. Though I agree a service would be nicer.

[localzuk]

My thoughts are 'That sounds like a plan!'

 

However I am not a programer.

 

It would be great if we could deploy this as a server only based solution to speed up deployment/re-deployment. Would that be an option?

 

Edit: I have noticed that the scripts are, of course, dependant upon DNS to correctly identify the station the user is logged onto. I have seen some stations mis-identified in the logs today. I will have to tackle my DHCP/DNS issues but is there a way of picking up the station name from the station locally [the station the user is logging onto] rather than have the script ask DNS for a name resolution? [Only my servers and printers have static IPs]

 

Interesting, a server side only option could work. All log-on and log-off can be set to be logged in the event log, so something could be set to monitor them. However, I think the system would be susceptible to the crashed/missing log-off events. So, if someone's computer crashes, the server won't have record of it.

 

This is why the client side service would be more reliable - it would poll.

 

However, thinking about it, if WMI were used, this might be able to be overcome, as the server could be set to poll. You could do this several ways - for example, by combining with the event logs - so you'd only poll the machines which have recent events. Either that, or you'd have to ping the network (and therefore ICMP would need to not be blocked on clients), to discover active windows machines, and then poll those which are active.

 

Sorry about all that, spit balling ideas in my head

 

And to answer your question about machine name, a local client can get it from environmental variables easily in .Net. Very simple.

 

In a sense that’s what my third script does; it checks periodically that the records are a true reflection of who is actually logged on. Though I agree a service would be nicer.

 

It shouldn't be that difficult to figure out I don't think. I may give it a go once i've finished my kiosk.

[PiqueABoo]

For one thing, it performs an irreversible Active Directory Schema modification (!)

 

::shrug:: As someone who registered an OID for doing precisely that 10+ years ago, I find that about as scary as some app creating a registry key. We obviously don't want every other app extending the schema coz the poor quality of too many apps means it would get ugly, but an unused schema extension (which I assume in this case just describes a new attribute or two for use with a user object) is not IMO, a big deal.

 

 

LimitLogon using AD and a deletable app partition doesn't seem at all strange to me, it was the SOAP that made me groan.

[Kipling]

Interesting, a server side only option could work.

I like the idea of using the event logs, that’s a blinder of an idea; you could effectively eliminate any client logging requirements. Are logon/off events logged with the computername information?

 

 

if someone's computer crashes, the server won't have record of it.

This is why the client side service would be more reliable - it would poll.

 

 

For polling (serverside), all I currently do (in batch) is query any client that has an active open logon (that is to say – has a record in the share) to discover who (if anyone) is currently logged on. If the records match then all is well in the world. If not, I assume an orphaned file and delete it. I only check every 20 minutes, which means anyone who suffered a crash can a) log straight back on to the same PC, or b) wait a maximum of 20 minutes before logging on somewhere else.

 

My logic was that 20 minutes would be long enough to be a punishment and short enough to make if not worth while tracking me down.

 

So to pin those together maybe two timers one faster one taking care of forcing logoffs when multiple logons are detected (actuallt I’d hazard a guess that eventlog events probably trigger a hook-able event), and a second slower timer taking care of orphans.

 

 

The whole thing could be totally server side then?

 

It feels like a very elegant solution is bubbling to the surface in this thread.

[PiqueABoo]

Multiple DCs = several places to look for logon events.

 

If I were interested in doing something for this I'd start with: "How do those AD integration products for firewalls monitor logons?".

[localzuk]

Multiple DCs = several places to look for logon events.

 

True, but that could be written into the server side app - ie. deploy it on each server and have it coded to talk to other, configured, servers.

 

If I were interested in doing something for this I'd start with: "How do those AD integration products for firewalls monitor logons?".

 

I don't understand. What do you mean?

[PiqueABoo]

Some posh and very serious firewalls of my acquaintance can be configured to apply policy based on Windows domain group membership etc. In order to do this the vendors will typically provide software that lives on all your DCs, to track who is logged on where at any point in time (and what groups they belong to). It's 99% the same problem.

 

So how do they hook domain logon events (I don't mean event log events)?

How do they detect logoffs?

How do they deal with machines reset rather than logged off?

Etc.

 

PS: I've done event log event grabbing. The hook I found for that doesn't cut it because MS don't notify you for every single event i.e. you'll only get one notification with an event attached in a particular time slot (I forget how long). So you end up having to go look at the event log(s) anyway and enumerate the events that have turned up since last time, and when you're doing that you have to wonder whether it isn't easier to just skip the hooking and just go look at the event log from whatever point you were at last time every 10 secs or whatever. Oh and also accomodate log wrapping, clearing and so on. It's a bit fiddly.

Edited March 18, 2010 by PiqueABoo
PS

[FAA]

File servers usually show hundreds of logon and logoff events for the same user throughout the day, because each time a user maps a drive to a server, opens up a file on this server and then closes it, the file server closes (within just seconds or at the most a couple of minutes) that logon session and logs a logoff event …

 

Good luck with the filtering!

 

On the contrary, UserLock only logs an event when a user opens a desktop session, when he locks/unlocks his desktop and when he logs off.

This will usually generate 4 events per day (maybe a bit more if a password protected screensaver is configured) and will allow SysAdmins to seamlessly analyze and archive session history.