Account Logon Notification

[dobsonl]

Hi,

 

Does anybody know of a way to be notified when certain accounts logon to the network? For example a hidden account that is used to catch the students sending spam around....

 

Don't worry if you don't, it will just mean getting my VB.net scripting hat back out of the box

 

Thanks

[Steve21]

Depends how you mean, If you want it to alert server side? Client side? Or what.

 

Steve

[SYNACK]

If you have 2008 domain controllers then you can use a scheduled task that looks for the logon event and checks if the username you are after is present using the custom filter option. You can then just use a command line email sending application or a script to send an email.

 

You could also make an app that subscribes to the windows event log service and checks for the username then does the same but it seems like overengineering.

[dobsonl]

Sorry forgot to mention some important details, guess that's what I get for doing multiple things at once!

 

We run a 2003 DCs, on a 2000native domain level! I know upgrade time!

Ideally I would like it to be almost instant, so that we can catch them in the act. So it would need to alert us in the office.....

 

Any ideas would be great fully received.

[SYNACK]

Event Log Monitoring maybe.

[PiqueABoo]

You could also make an app that subscribes to the windows event log service and checks for the username then does the same but it seems like overengineering.

 

I hope it is easier now, but when I tried that with dotNet a few years ago it was rate limited i.e. your callback code would be thrown a new event record at a maximum rate of something like one every two seconds i.e. if 100 happened in that period you only saw one of them. That behaviour was explicitly mentioned in the kind of MS documentation you only find *after* you've spent a while wondering if you've done something so incredibly stupid you can't see it.

 

[Already had 'old school' code that polled the logs and was contemplating updating/simplifying it with the subscription method, but gave up on that ].

[TheScarfedOne]

I could probably modify the script i have for checking the workstation name to instead do a case statement on logged on username and trigger an SMTP call. Will have a go at it next week...

[dobsonl]

Thanks all for your advice - been playing in VB2010 today and not actually progressed very far to be fair. Think this might be an easier said than done sort of thing....

[ricki]

HI

 

Have a look at net send Microsoft Corporation and may be put it in a log on script for that user.

 

Richard

[Michael]

If you open up Computer Management, you can view Sessions and Open Files. Not the best way, but this can give you an idea who's on the network.

[ZeroHour]

What OS is your clients?

I have seen a couple of examples of scripts to get around this, googling.

[webman]

If you implemented my LoginTracker system, you could modify that to email you when a certain user logs in.

 

That is a planned feature for the future of LoginTracker, but should be easy enough to add on yourself with a bit of PHP knowledge.