Who has logged on where?

[RiffRaff]

Can anybody tell me how I can get a log of of all our pupils and staff logons?

 

It's mainly to be able to show who was sat a particular PC at a particular time (in the event of vandalism etc.)

 

Thanks

[MattHarwood]

I have a batch script for this. PM me your email if you'd like a copy!

[british_government]

Im sure there is probably a built in windows solution but i highly recomend this software. Computer and Internet Monitoring Software - Forensic Software

Policy Central takes screen captures if any banned word ever appears on a student's screen, you can get a lot of false positives but even if it is just 0.1% you pick up it is worth it.

 

Also, back to your original post, you can setup an AUP that shows on every logon and it records, who when and where this AUP is accepted, making tracking machine and students is very very easy.

[SC92]

If you go to the C: drive of a station, and (depending on OS) navigate to the Users folder or Documents & Settings on Windows 7, and then all you have to do is filter it into date order accordingly. Shows the date/time logged out of stations for us. Not sure if this is the kind of solution you had in mind but it's a start at least hopefully.

[FN-GM]

I use these batch files at logon and logoff

 

rem The following line creates a rolling log file of usage by workstation
echo Log In %Date% %TIME% %USERNAME% >> \\server\share\%COMPUTERNAME%.log

rem The following line creates a rolling log file of usage by user
echo Log In %Date% %TIME% %COMPUTERNAME% >> \\server\share\%USERNAME%.log

 

 

rem The following line creates a rolling log file of usage by workstation
echo Log Out %Date% %TIME% %USERNAME% >> \\server\share\%COMPUTERNAME%.log

rem The following line creates a rolling log file of usage by user
echo Log Out %Date% %TIME% %COMPUTERNAME% >> \\server\share\%USERNAME%.log

[MattHarwood]

Exactly the same here

 

I use these batch files at logon and logoff

 

rem The following line creates a rolling log file of usage by workstation
echo Log In %Date% %TIME% %USERNAME% >> \\server\share\%COMPUTERNAME%.log

rem The following line creates a rolling log file of usage by user
echo Log In %Date% %TIME% %COMPUTERNAME% >> \\server\share\%USERNAME%.log

 

 

rem The following line creates a rolling log file of usage by workstation
echo Log Out %Date% %TIME% %USERNAME% >> \\server\share\%COMPUTERNAME%.log

rem The following line creates a rolling log file of usage by user
echo Log Out %Date% %TIME% %COMPUTERNAME% >> \\server\share\%USERNAME%.log

[cpjitservices]

I can't get the script to create the log file... I get UNC not supported.

[6Foot2]

I can't get the script to create the log file... I get UNC not supported.

 

Have you created the share at the server properly? [Have you created the share at all? (I ask this because I saw someone else make the same mistake a long time ago]

Have you checked the Sharing Permissions/Security Permissions?

Could there be an error in your script?

[cpjitservices]

Yep share created, Setup permissions so that the user accounts and admins can write to the folder.

 

The script could be wrong but I copy and pasted it and all I changed was the part where I enter my servers details.

[6Foot2]

Can you browse to the location on the server where you have set up the shares in [Windows] Explorer?

[cpjitservices]

Indeed I can, even on a standard user account I can browse to it, although it may be that batch files and CMD are disabled on accounts in GPO, I have copied the scripts into my netlogon folder and assigned them as logon and logoff scripts in GPO. Edited March 20, 2012 by cpjitservices

[6Foot2]

Can you run the batch file as a privileged [Administrator/Technician?] user?

 

Does it create the entries in the log file as you would expect?

[sidewinder]

I use these batch files at logon and logoff

 

rem The following line creates a rolling log file of usage by workstation
echo Log In %Date% %TIME% %USERNAME% >> \\server\share\%COMPUTERNAME%.log

rem The following line creates a rolling log file of usage by user
echo Log In %Date% %TIME% %COMPUTERNAME% >> \\server\share\%USERNAME%.log

 

 

rem The following line creates a rolling log file of usage by workstation
echo Log Out %Date% %TIME% %USERNAME% >> \\server\share\%COMPUTERNAME%.log

rem The following line creates a rolling log file of usage by user
echo Log Out %Date% %TIME% %COMPUTERNAME% >> \\server\share\%USERNAME%.log

 

Thankyou for this, so simple I dont know why I didnt think of it before. Previously had everything writing to a single file, which obviously made it a huge pain trying to search through for a single PC/user

[internetuser]

Any way to get this to write to a database, either via a bat or vbs/powershell ?

[internetuser]

found it, this is what I needed to use

 

IPCONFIG |FIND "IP" > %TEMP%.\TEMP.DAT

FOR /F "tokens=2 delims=:" %%a in (%TEMP%.\TEMP.DAT) do set IP=%%a

del %TEMP%.\TEMP.DAT

set IP=%IP:~1%

 

echo %username%, %computername%, %date%, %time%, %ip% >>\\server\share\logon.csv

[tom_newton]

Your web filter may keep such things in its logs. These things might be rather well hidden...

[internetuser]

Not all users, use the internet tho or user may only use local hosted sites which the webfilter will not pick up

[FN-GM]

Any way to get this to write to a database, either via a bat or vbs/powershell ?

 

There is one on here some place that will go to an access database. The issue was it got full fairly quick.

[edutech4schools]

http://www.edugeek.net/forums/how-do-you-do/91722-auto-populate-ad-computer-description-last-user-logged-serial-number.html

[sted]

http://www.edugeek.net/forums/how-do-you-do/91722-auto-populate-ad-computer-description-last-user-logged-serial-number.html

 

im currently writng a better version of my script its about half the lines and atm dumps to csv will be adding ad (with comparison to current data when i get time and am in the right frame of mind to code)

[ninjabeaver]

I'll keep an eye out for that then.

[sted]

for what its worth current code (just dumps to csv and no last logged on user im trying to find a good solution for xp and win7 atm guessing that may be a case of copying a local file into it but not 100% sure atm

 

Option Explicit
'On Error Resume Next

dim outputstring, computermodel, cpu, ram, hddcapacity, hddfree, serialno, macaddress, operatingsystem
dim stcomputer, colitems, objItem, colcpu, colPhysicalMemory, objPhysicalMemory, intMemory, colDisks, objhdd
dim colComputerSystem, colOperatingSystems, objOperatingSystem, colBIOS, objBIOS, colnicconfig, objnicconfig
dim objwmiservice, hddtemp
Dim strDirectory, strFile, strText, WshNetwork, wshShell, pcname, objFSO, objFolder, objFile, objTextFile

stcomputer = "."

Set objWMIService = GetObject("winmgmts:\\" & stcomputer & "\root\CIMV2") 
Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_ComputerSystem") 
Set colcpu = objWMIService.ExecQuery("Select * from Win32_Processor")
Set colPhysicalMemory = objWMIService.ExecQuery("Select * From Win32_PhysicalMemory")
set coldisks = objWMIService.ExecQuery("Select * From Win32_LogicalDisk") 
Set colComputerSystem = objWMIService.ExecQuery("SELECT * FROM Win32_ComputerSystem")
Set colOperatingSystems = objWMIService.ExecQuery ("Select * from Win32_OperatingSystem")
Set colBIOS = objWMIService.ExecQuery("Select * From Win32_BIOS")
Set colnicconfig = objWMIService.ExecQuery("Select * From Win32_NetworkAdapterConfiguration Where IPEnabled = True")
Set WshNetwork = WScript.CreateObject("WScript.Network")
Set wshShell = WScript.CreateObject( "WScript.Shell" )

pcname = wshShell.ExpandEnvironmentStrings( "%COMPUTERNAME%" )
strDirectory = "\\server1\logs$\pc\"
strFile = pcname & ".csv"

'make-model
For Each objItem In colItems 
computermodel= objItem.Manufacturer & " " & objItem.Model
'wscript.echo computermodel
Next

'cpu info
For Each objItem in colcpu
   cpu = objItem.Name
'wscript.echo cpu
Next

'ram
If Not colPhysicalMemory Is Nothing Then
 intMemory = 0
 For Each objPhysicalMemory In colPhysicalMemory
	 intMemory = intMemory + Int(objPhysicalMemory.Capacity)
 Next
 ram = (intMemory / 1024 / 1024 ) & " MB"
 'wscript.echo ram
End If

'hdd capacity
for each objhdd in coldisks
If objhdd.DeviceID = "C:" Then
	hddcapacity = int(objhdd.Size/1073741824) & " GB"
	hddfree = int(objhdd.freespace/1073741824) & " GB"
	'wscript.echo hddfree
end if
next

'windows version
For Each objOperatingSystem in colOperatingSystems
   operatingsystem = objOperatingSystem.Caption & " sp " & objOperatingSystem.ServicePackMajorVersion
'wscript.echo operatingsystem
Next

'serial no
If Not colBIOS Is Nothing Then
 For Each objBIOS in colBIOS
	 serialno = objBIOS.SerialNumber
	 'wscript.echo serialno
 Next
End If

'mac address(s)
If Not colnicconfig Is Nothing Then
 For Each objnicconfig in colnicconfig
	 If macaddress <> "" Then
		 macaddress = macaddress & ", "
	 End If
	 macaddress = macaddress & objnicconfig.MACAddress
	 'wscript.echo macaddress
 Next
End If

'concatanate data for output
outputstring = pcname & "," & computermodel & "," & cpu &"," & ram &"," & hddcapacity& "," & hddfree & "," & serialno & "," & operatingsystem & "," & macaddress
'wscript.echo outputstring

' Create the File System Object
Set objFSO = CreateObject("Scripting.FileSystemObject")

' Check that the strDirectory folder exists
If objFSO.FolderExists(strDirectory) Then
  Set objFolder = objFSO.GetFolder(strDirectory)
Else
  Set objFolder = objFSO.CreateFolder(strDirectory)
  'WScript.Echo "Just created " & strDirectory
End If

If objFSO.FileExists(strDirectory & strFile) Then
  Set objFolder = objFSO.GetFolder(strDirectory)
Else
  Set objFile = objFSO.CreateTextFile(strDirectory & strFile)
  'Wscript.Echo "Just created " & strDirectory & strFile
End If 

set objFile = nothing
set objFolder = nothing
' OpenTextFile Method needs a Const value
' ForAppending = 8 ForReading = 1, ForWriting = 2
Const ForAppending = 2

Set objTextFile = objFSO.OpenTextFile _
(strDirectory & strFile, ForAppending, True)

' Writes result every time you run this VBScript
objTextFile.WriteLine(outputstring)
objTextFile.Close

 

to make it read better with multiple pcs i create a 01.csv with column headers (01 as thats alphabeticaly about as low as i can get then run a script to merge them all into one big csv

del "D:\pc\logs\pc\all.csv" /q
copy "D:\pc\logs\pc\*.csv" "D:\pc\logs\pc\all.csv" /y

[JRyce]

This is fantastic! Just gave it a try and love the results. Thanks so much, James.

 

I use these batch files at logon and logoff

 

rem The following line creates a rolling log file of usage by workstation
echo Log In %Date% %TIME% %USERNAME% >> \\server\share\%COMPUTERNAME%.log

rem The following line creates a rolling log file of usage by user
echo Log In %Date% %TIME% %COMPUTERNAME% >> \\server\share\%USERNAME%.log

 

 

rem The following line creates a rolling log file of usage by workstation
echo Log Out %Date% %TIME% %USERNAME% >> \\server\share\%COMPUTERNAME%.log

rem The following line creates a rolling log file of usage by user
echo Log Out %Date% %TIME% %COMPUTERNAME% >> \\server\share\%USERNAME%.log

[jmhopkins]

Can anybody tell me how I can get a log of of all our pupils and staff logons?

 

It's mainly to be able to show who was sat a particular PC at a particular time (in the event of vandalism etc.)

 

Thanks

 

Here is my simple vbs script on login which posts login time, name, and computer to an SQL Table. (It also puts the last logged in user and timestamp in the AD computer comment..) Call it from Group Policy Login Script.

 

 

'On Error Resume Next

 

Set objSysInfo = CreateObject("ADSystemInfo") 'Bind to AD

Set objNet = CreateObject("WScript.Network")

 

strCompDN = objSysInfo.ComputerName 'DN for computer, e.g. "CN=VISTAWORKSTATION,OU=Child OU Name,OU=Parent OU Name,DC=domain,DC=com"

 

Set wshShell = WScript.CreateObject( "WScript.Shell" )

strComputerName = wshShell.ExpandEnvironmentStrings( "%COMPUTERNAME%" )

 

 

 

strCompName = objSysInfo.ComputerName

 

Set objComp = GetObject("LDAP://" & strCompDN) 'IADsComputer object

 

strUserDN = objSysInfo.UserName 'DN for user, e.g. "CN=John Smith,OU=Child OU Name,OU=Parent OU Name,DC=domain,DC=com"

Set objUser = GetObject("LDAP://" & strUserDN) 'IADsUser object

 

strUsrLogin = LCase(objNet.UserName)

 

'Parse out datestamp in text format.

strNow = Now

strDateStamp = DatePart("yyyy",strNow) & _

Right("0" & DatePart("m",strNow), 2) & _

Right("0" & DatePart("d",strNow), 2) & _

"@" & _

Right("0" & DatePart("h",strNow), 2) & _

Right("0" & DatePart("n",strNow), 2)

 

'RegExp object used to perform a simple match on IP address

Set objRE = New RegExp

objRE.IgnoreCase = True

'Note this regexp pattern isn't "correct" for matching an IPv4 address properly, but since WMI will return an

'array of IP addresses, this is sufficient to distinguish IPv4 vs IPv6

objRE.Pattern = "^\d+\.\d+\.\d+\.\d+$"

 

strIP = ""

 

'Connect to WMI and retreive all network adapters

Set objWMI = GetObject("winmgmts:")

Set colNICs = objWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration")

 

'Get the IP(s) assigned to whichever network adapter has our default gateway

If colNICs.Count > 0 Then

For Each objNIC in colNICs

If IsArray(objNIC.DefaultIPGateway) Then

arrIP = objNIC.IPAddress

For i = 0 To UBound(arrip)

If objRE.Test(arrIP(i)) Then strIP = strIP & " " & arrIP(i)

Next

strMAC = objNIC.MACAddress

End If

Next

End If

 

strIP = Trim(strIP)

 

objComp.Description = strDateStamp & " " & strUsrLogin & " " & strIP

'Or, put them in separate attributes in AD

'objComp.Put "extensionAttribute1", strUsrLogin

'objComp.Put "extensionAttribute2", strIP

'objComp.Put "extensionAttribute3", strMAC

objComp.Setinfo

 

 

strLogFile = "'" & strComputerName & "', '" & strNow & "','" & strUsrLogin & "','" & strIP & "'"

'wscript.echo strLogFile

 

Const DB_CONNECT_STRING = "Provider=SQLOLEDB.1;Data Source=SqlServerName;Initial Catalog=Database;user id ='SqlUser';password='SqlPassword'"

Set myConn = CreateObject("ADODB.Connection")

Set myCommand = CreateObject("ADODB.Command" )

myConn.Open DB_CONNECT_STRING

Set myCommand.ActiveConnection = myConn

strCommandString = "INSERT INTO table_ComputerLog (ComputerName,LoginTime,Username,IPv4) VALUES( "

strCommandString = strCommandString & strLogFile & ")"

 

 

 

myCommand.CommandText = strCommandString

myCommand.Execute

myConn.Close

 

 

Set objWMI = nothing

Set colNICs = nothing

[AJWhite1970]

My file is similar to most with a couple of extra logs created:

 

echo LOGIN %date%, %time%, %computername%, %username%, >> \\server\apps\OCS\Logs\login.csv

echo LOGIN %date%, %time%, %computername%, %username%, >> \\server\apps\OCS\Logs\Users\%username%.csv

echo LOGIN %date%, %time%, %computername%, %username%, >> \\server\apps\OCS\Logs\PCs\%computername%.csv

echo LOGIN %date%, %time%, %logonserver%, %computername%, %username%, >> \\server\apps\OCS\Logs\Domain\%logonserver%.csv

 

1) rolling record of every login

2) login history per user

3) login history per PC

4) rolling record of logins serviced by DC (very quick reference guide to see load balancing is working)

 

Andrew