It’s 10:00 P.M.: Do You Know Who’s Logged On?

Systems engineer Michael Dragone’s batch-file solution tracks employee logons by user and computer

Security problems are typically a small part of Michael Dragone's job as a systems engineer for Titleserv, a title insurance and real estate services firm in Woodbury, New York. But when senior management asked him to devise a way to track employees' network logons and logoffs, Michael was challenged to find a solution that didn't rely on the Active Directory (AD) Security event log, which retains logons, logoffs, privilege assignments, and other events only for a short time until they're overwritten. Michael talked to me about how he fulfilled management's request by using straightforward batch-file scripting to capture logon/logoff data on the clients and move that data into text files and folders for easy retrieval.

What inspired you to create the user logon/logoff solution?
Our internal production system is a Web application based on Microsoft .NET Framework, and it has an internal logging component that tells you when people logged on, when they logged off, what they did, and so on. We had a lot of requests from management to provide a similar capability for our end users' PCs. A manager might want to know, for example, if someone requested overtime pay last month, whether that employee was really working overtime. To confirm this, the manager wanted to be able to find out when someone logged on or whether an employee was working on a particular computer at a particular time. That information is logged in AD, but it goes in the Security event log, which can't retain more than 50MB of data and has other events besides those management wanted to track. It would take a lot of scraping through the logs to find the information management wanted. . . .

I was hoping to get some good info from this article regarding how the script was created. Unfortunately it was much more simple than the one I currently use. I guess it would be a good starting point in tracking the users.
The solution I have runs in much the same way but instead copies the file to a hidden network path, and stored in a CSV delimited file. The file contains several fields which would allow me to sort the data if necessary in an Access or Excel program. I too have it running from the GPO in the Default Domain Policy/User configuration/Windows Settings under LOGON/LOGOFF.

Here is how my bat file looks.
@Echo off
Rem Extract only the last IP address from the list
FOR /F "TOKENS=2* DELIMS=:" %%A IN ('IPCONFIG /ALL ^| FIND "IP Address"') DO FOR %%B IN (%%A) DO SET IPADDR=%%B

Rem Extract the NETBIOS name
FOR /F "TOKENS=2* DELIMS=:" %%A IN ('IPCONFIG /ALL ^| FIND "Host Name"') DO FOR %%B IN (%%A) DO SET netbiosname=%%B

Rem Extract the MAC ADDRESS
FOR /F "TOKENS=2* DELIMS=:" %%A IN ('IPCONFIG /ALL ^| FIND "Physical Address"') DO FOR %%B IN (%%A) DO SET macaddress=%%B

echo S,%DATE%,%TIME%,%username%,%netbiosname%,%ipaddr%,%macaddress% >> n:\Logs\PCs\%netbiosname%.txt

The last line saves the data to the CSV file. The 'S' stands for SignOn, use the same bat file in your logoff but replace the 'S' with an 'O' or whatever to denote sign-off.

With this solution you can look at all of the computers in one directory. I have a scheduled task which runs on the first that creates a directory and moves all of the files there.
Something else this solution solves for me is that I have users who roam the network when they login in order to do their job. A simple COPY statement of all the files and dump it to Access, and you know when and where they last logged in for the month, including our TS users.

I think you'll find this to be a better solution and no more difficult to implement and easier to manage given that the data is stored centrally.
Jake

Jakesty June 07, 2007 (Article Rating:

)

Jakesty,
Nice script. Thanks

baronferg June 07, 2007 (Article Rating:

)

Jakesty: Thanks for reading the article and taking the time to post your script! It's good to hear what readers like you are doing and different approaches you're taking to solving the problems discussed in our articles. It looks as if at least one person has found your alternative logon/logoff tracking solution helpful. I've passed along your comment to Mike Dragone so that he can respond.
--Anne Grubb, senior editor, Windows IT Pro

AnneG_editor June 11, 2007 (Article Rating:

)

Nice script, Jakesty. The beauty of this solution is that you can extend it in whatever way fits your environment. In my case I didn't need to capture as much information as you do. If I were to deploy this solution to a larger userbase I would definately track more information such as IP address.

One nice benefit that I see with using a straight "pre-formatted" text file rather than one formatted in CSV is that I can e-mail the entire text file to a manager without having to go though and parse it first before sending it off.

mdragone June 11, 2007 (Article Rating:

)

Thank you, it is just something that develops over time and I have just combined a lot of the info I have found and put it all together in simple scripts like these.

Here is that other script to create the folder and move all of the files into the new folder. This way you'll have a separated list of logins on a per month basis. Just add this bat file to your task list.

FOR %%A IN (%Date%) DO SET Today=%%A

FOR /F "tokens=1-3 delims=/-" %%A IN ('ECHO.%Today%') DO SET SortDate=%%C%%A%%B

md \\server1\public\ipconfig\pclogin\%SortDate%

move \\server1\public\ipconfig\pclogin\*.txt \\server1\public\ipconfig\pclogin\%SortDate%

Jakesty June 18, 2007 (Article Rating:

)

Very cool; I will implement tomorrow.

GuruLeeNyc June 20, 2007 (Article Rating:

)

Just what i was looking for, thanks

deeuk June 22, 2007 (Article Rating:

)

i was just wondering if there was a way in which you could log the activity of the user who was logged on. Anybody know of such a script?

deeuk June 22, 2007 (Article Rating:

)

You must log on before posting a comment.

If you don't have a username & password, please register now.