Track user logons?

[Jon1]

In Server 2003 is there any way i can track who is logging on when and/or where? We have an issue where one of our staff members seems to be logging on as another user, or as themsleves at strange times?

[Geoff]

You can do this via audit logging.

[djm968]

Try these VB Scripts

 

Logon.vbs

 

Const ForReading = 1, ForWriting = 2, ForAppending = 8 
Set objNetwork = CreateObject("Wscript.Network") 

  Dim fso, f 
  Set fso = CreateObject("Scripting.FileSystemObject") 

'alter the path to the file as needed for your environment 

strNewFile = "C:\Userlog" & Replace(FormatDateTime(Now(), vbShortDate) & ".csv", "/", "") 

Set f = fso.OpenTextFile(strNewFile, ForAppending, True)

strComputer = objNetwork.ComputerName 
strUser = objNetwork.UserDomain & Chr(92) & objNetwork.UserName 

'alter the text strings as you like 
f.Write strUser & "," & strComputer & "," & Date & "," & Time & "," & "Logon" & vbCrLf
f.Close 

 

Logoff.vbs

 

Const ForReading = 1, ForWriting = 2, ForAppending = 8 
Set objNetwork = CreateObject("Wscript.Network") 

  Dim fso, f 
  Set fso = CreateObject("Scripting.FileSystemObject") 

'alter the path to the file as needed for your environment
strNewFile = "C:\Userlog" & Replace(FormatDateTime(Now(), vbShortDate) & ".csv", "/", "") 

Set f = fso.OpenTextFile(strNewFile, ForAppending, True)

strComputer = objNetwork.ComputerName 
strUser = objNetwork.UserDomain & Chr(92) & objNetwork.UserName 


  'alter the text strings as you like 
  f.Write strUser & "," & strComputer & "," & Date & "," & Time & "," & "Logoff" & vbCrLf
  f.Close 

 

These scripts log the username, computer name, time, date and the event to a date coded csv file.

 

I would recommend that CSV file is located on a server share and the path to the file modified for both scripts.

[tarquel]

Can it be a UNC path then for the logfile?

 

Nath.

[djm968]

Can it be a UNC path then for the logfile?

 

Nath.

 

Yes, however the user will need write access to the UNC path if the scripts are executed at user logon\logoff

[strawberry]

echo %date% %time% %computername% %username% >>\\servername\logon\log.txt

 

tack that onto your logon script. works a treat.

[ZeroHour]

I created my own system based on autoit and php/mysql

It logs times when people log on, where they are, when they leave and I have it projected onto a wall giving the current amount of staff,pupils and the amount of pc's logged onto this week (like 200/500).

Its web based for viewing the DB and you can wildcard search for pcs and users.

I can provide the info you need to enable your network to do it.

[kearton]

i'd be very interested in that, ZeroHour... (as I'm sure many others would)

[MkII]

Sounds great ZH - how much can I pay you!

[ZeroHour]

Cool, if there is a interest I will work on a pack for some people to test.

PM me if you would like to help beta test. MSN Messenger users are v welcome as its faster for debugging.

 

Mark I accept beer like all good techies

[Jon1]

echo %date% %time% %computername% %username% >>\\servername\logon\log.txt

 

tack that onto your logon script. works a treat.

 

Ive tried that but it doesnt seem to work?

[Jon1]

Try these VB Scripts

 

Logon.vbs

 

Const ForReading = 1, ForWriting = 2, ForAppending = 8 
Set objNetwork = CreateObject("Wscript.Network") 

  Dim fso, f 
  Set fso = CreateObject("Scripting.FileSystemObject") 

'alter the path to the file as needed for your environment 

strNewFile = "C:\Userlog" & Replace(FormatDateTime(Now(), vbShortDate) & ".csv", "/", "") 

Set f = fso.OpenTextFile(strNewFile, ForAppending, True)

strComputer = objNetwork.ComputerName 
strUser = objNetwork.UserDomain & Chr(92) & objNetwork.UserName 

'alter the text strings as you like 
f.Write strUser & "," & strComputer & "," & Date & "," & Time & "," & "Logon" & vbCrLf
f.Close 

 

Logoff.vbs

 

Const ForReading = 1, ForWriting = 2, ForAppending = 8 
Set objNetwork = CreateObject("Wscript.Network") 

  Dim fso, f 
  Set fso = CreateObject("Scripting.FileSystemObject") 

'alter the path to the file as needed for your environment
strNewFile = "C:\Userlog" & Replace(FormatDateTime(Now(), vbShortDate) & ".csv", "/", "") 

Set f = fso.OpenTextFile(strNewFile, ForAppending, True)

strComputer = objNetwork.ComputerName 
strUser = objNetwork.UserDomain & Chr(92) & objNetwork.UserName 


  'alter the text strings as you like 
  f.Write strUser & "," & strComputer & "," & Date & "," & Time & "," & "Logoff" & vbCrLf
  f.Close 

 

These scripts log the username, computer name, time, date and the event to a date coded csv file.

 

I would recommend that CSV file is located on a server share and the path to the file modified for both scripts.

 

Im sorry, i dont know VB. Ive nver really looked at it so i dont know that to do with the information you have given me! :oops:

[ZeroHour]

The biggest problem with these scripts are that if a pupil wants to be evil he can clear the logs as he has permissions. I know I would look/find it if I was going to do damage.

 

Let me rephrase my beta call-out, I need people to help me make sure its generic for every network before I release it to the wild. I dont see any problems but best to test

Its fairly simple and since its web based primarily, it should not effect your network running it. It works good for us and kids would have a v hard time faking entries.

 

Added: This post has a couple of screenie showing 2 aspects of the sys.

[Geoff]

OCS Inventory logs user logins.

[ZeroHour]

Oooh having a look. Does it log logout times?

[Geoff]

Not really. You can sort of work it out though.

[strawberry]

echo %date% %time% %computername% %username% >>\\servername\logon\log.txt

 

tack that onto your logon script. works a treat.

 

Ive tried that but it doesnt seem to work?

 

apend it onto the end of a bat logon script. as is, apart from the unc part at the end which needs to point to a folder taht has modify perms all round.

[Jon1]

It works it works!

 

However apparently only 3 people have logged on today??

[strawberry]

how many where you expecting?.

 

remember it doesn't track log offs either!.

[Jon1]

Was expecting about 15-20?

[djm968]

Im sorry, i dont know VB. Ive nver really looked at it so i dont know that to do with the information you have given me! :oops:

 

Copy and paste the code into two seperate text files named logonaudit.vbs and logoffaudit.vbs

 

Using group policy, add these scripts as logon and logoff scripts in the windows settings of the user configuration.

 

Users should only require Create Files / Write Data permissions on csv file, therefore security should security shouldn't be an issue.

[strawberry]

Was expecting about 15-20?

 

hmmm, can only imagine the logon scripts aren't running properly or the permissions on the folder aren't right.

 

have you checked that all the people you expect to be tracking are using the logon script?

[tango]

Hi ZeroHour,

 

I'd certainly be interested in testing the script

[Jon1]

Was expecting about 15-20?

 

hmmm, can only imagine the logon scripts aren't running properly or the permissions on the folder aren't right.

 

have you checked that all the people you expect to be tracking are using the logon script?

 

Well, the group policy for staff members is that it runs staff.bat on logon. However the log only contains 3 peoples login information, mine and two teachers!

 

How do i check that all the members of the staff group are executing the script at logon?

[strawberry]

normally i would recommend using a text file to check the logon script was working!.

 

in this case i guess the most obvious thing to do is check to see what else the script should be doing and seeing if taht works. i'd imagine your logon script would be doing things like mapping drives and adding printers.