Track user logons?

[Jon1]

normally i would recommend using a text file to check the logon script was working!.

 

in this case i guess the most obvious thing to do is check to see what else the script should be doing and seeing if taht works. i'd imagine your logon script would be doing things like mapping drives and adding printers.

 

Yes, and it does do that, although it misses off one printer. We changed the driver for the photocopier printer from RPCS to PCL and it doesnt change it like it should.

 

Other than that it appears to be working correctly, but i dont really know what im looking at.

[strawberry]

not sure to be honest then chap. its a fairly simple script, if the permissions on the folder are set to everything for everybody and the code is correct in the script then it should all work.

[Jon1]

Hi

 

Ive double checked and "everyone" has full control of the folder, and everyone in the staff group is set to run staff.bat so i cant work out whats wrong?

 

Mind you this school is the Bermuda triangle - things that should logically work dont, and things that shouldnt work do!

[strawberry]

maybe they're not logging off? maybe theyre just hibernating.

 

i know when i changed the printer names and thus the scripts here it took a month of calls to the helpdesk before people bothered to log off.

[Jon1]

Possible i suppose. Im investigating the oter thread of forcing user logoffs with great interest!

[CHR1S]

Wouldnt it be a little safer to map a drive, write to it then unmap it in the same script? Its a little time consuming but if it was hidden in the background it should be ok?

[projector1]

just been reading my WindowsITPro mag for june and saw this article

 

http://www.windowsitpro.com/Articles/ArticleID/95922/95922.html

 

 

 

the article covers a story of a IT pro who developed a solution for his firm to see who's logged in. It also contains a nice comment from another Pro who has his own method of seeing who's logged in

[ZeroHour]

Yeh but it has the same limitations as most of the other solutions, that why I made my own

I have a few people now and we are testing it with different systems to make a guide before releasing it.

Any ideas for names?

[ChrisP]

This is the VB script i knocked up to 'keep an eye on things'.....

I have a few scripts that run, this one is mainly used for logging to a access database.

 

Then i got a nice web front end written for it that alerts me to things such as double logons, lets me probe this database in many ways, Thats part of my asp command and control centre i knocked up (winsuite logging, dhcp probe, user (adsi) admin, proxy logging etc.)

 

 

 

OK, OK - i know how messy it is. Yes i know i got Lazy on declarations (etc). However it works very well for me, maybe you can use/abuse/break it in some way.

 

 

 

_____________________________

 

On Error Resume Next
dim strKey, wshShell, intValue
Set WshShell 			= WScript.CreateObject("WScript.Shell")
Set FSO             		= CreateObject("Scripting.FileSystemObject")
Set WSHNetwork          	= WScript.CreateObject("WScript.Network")
Set objNet			=	CreateObject("wscript.Network")

strKey = "HKEY_LOCAL_MACHINE\SOFTWARE\Intel\Display\igfxcui\HotKeys"
wshShell.regWrite strKey, 0, "REG_DWORD"


strKey = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride"
wshShell.regWrite strKey, "gatekeeper1;*.earlham.local;", "REG_SZ"


oUN			=	objNet.UserName
objHost			=	objNet.ComputerName
strUserName             = ""

Set adoCon = CreateObject("ADODB.Connection")
While strUserName       = ""
WScript.Sleep 100
strUserName             = WSHNetwork.UserName

Wend

'---------------------------------
Set OSSet = GetObject("winmgmts:").InstancesOf("Win32_OperatingSystem")
For each OS in OSSet
Spack=OS.CSDVersion
if Spack="" Then Spack="Data not available"
Next
'---------------------------------
Set objFSO		= 	CreateObject("Scripting.FileSystemObject")
targetFolder		=	"c:\documents and settings\"
Set objFolder 		= 	objFSO.GetFolder(targetFolder)
Set colFiles 		= 	objFolder.subFolders
countFolders		=	0		
For Each objFile In colFiles
countFolders		=	countFolders + 1		
Next



strUserDomain           = WSHNetwork.UserDomain
Set ObjGroupDict        = CreateMemberOfObject(strUserDomain, strUserName)


		StartTime			=	time()
		sDomain 			= 	"domain"
		sGroupSelected 		= 	"Domain Users"
		sUserSelected 		=	strUserName
set objGroup 					= 	GetObject("WinNT://" & sDomain & "/" & sGroupSelected)
For Each objUser in objGroup.Members
		oNA					=	objUser.Name
		
If 	objUser.Class = "User" and oNA = sUserSelected Then
		oFN					=	objUser.FullName		
oAD					=	objUser.AccountDisabled	
		oLL					=	objUser.LastLogin		
		oLS					=	objUser.LoginScript
		oHD					=	objUser.HomeDirectory
		oDS					=	objUser.Description
	
					
Exit For

		

End If
Next	

adoCon.Open "Driver={Microsoft Access Driver (*.mdb)};DBQ=\\10.96.172.10\logging$\database\logon_watch.mdb"
Set oRS = CreateObject("ADODB.Recordset")
strSQL = "SELECT * FROM logons;"

oRS.CursorType = 2
oRS.LockType = 3

oRS.Open strSQL, adoCon
oRS.AddNew
oRS.Fields("user")  		=   oUN	
oRS.Fields("pc")  		=   objHost					
oRS.Fields("date")  		=   date()
oRS.Fields("time")  		=   Time()
oRS.Fields("domain")   		= strUserDomain           
oRS.Fields("servicepack")	=	Spack
oRS.Fields("profiles")		=	countFolders 
oRS.Fields("logonscript")  	=   oLS	
oRS.Fields("lastlogon")  	=   	oLL
oRS.Fields("fullname")  	=   	oFN
oRS.Fields("description")  	=   oDS
oRS.Fields("homedirectory")  	= oHD  
oRS.Fields("simsversion")  	= objFSO.GetFileVersion("c:\program files\sims\sims .net\pulsar.exe")
oRS.Fields("vncversion")  	= objFSO.GetFileVersion("C:\Program Files\RealVNC\VNC4\winvnc4.exe")
oRS.Fields("savversion")  	= objFSO.GetFileVersion("C:\Program Files\Sophos\Sophos Anti-Virus\SavMain.exe")
' oRS.Fields("flashversion")  	= objFSO.GetFileVersion("")

If MemberOf(ObjGroupDict, "staff") Then 
oRS.Fields("staff")	=	"TRUE"
End If


If MemberOf(ObjGroupDict, "students") Then
oRS.Fields("student")	=	"TRUE"
End If


If MemberOf(ObjGroupDict, "Watch") Then
oRS.Fields("watch")	=	"TRUE"
End If


oRS.Update
oRS.Close

Set oRS = Nothing
Set adoCon = Nothing



Function MemberOf(ObjDict, strKey)
MemberOf = CBool(ObjGroupDict.Exists(strKey))
End Function

Function CreateMemberOfObject(strDomain, strUserName)
Dim objUser, objGroup
Set CreateMemberOfObject    = CreateObject("Scripting.Dictionary")
CreateMemberOfObject.CompareMode = vbTextCompare
Set objUser = GetObject("WinNT://" & strDomain & "/" & strUserName & ",user")
For Each objGroup In objUser.Groups
CreateMemberOfObject.Add objGroup.Name, "-"
Next
Set objUser = Nothing
End Function