recording users logon/off times

  • Thread starter Thread starter mark
  • Start date Start date
M

mark

is there anyway to do this ?
i need to record when a user logson/off their machine, is this possible ?

cheers
mark
 
mark said:
is there anyway to do this ?
i need to record when a user logson/off their machine, is this possible ?

cheers
mark
Click to expand...
Turn on auditing for logon/logoff events. If these users are part of a
domain then do the auditing on the domain controller. All teh
logon/logoffs for every account on the domain will then be in the
security event log on the domain controller.
 
Brandon said:
Turn on auditing for logon/logoff events. If these users are part of a
domain then do the auditing on the domain controller. All teh
logon/logoffs for every account on the domain will then be in the security
event log on the domain controller.
Click to expand...

thanks for the reply, i'll try that

mark
 
You can do this via the event logs, but it's a major pain in the ass. You'd
be better off implementing your own solution, as the event logs won't cater
for unexpected shutdowns, disconnections, etc. and are also sadly lacking in
the exact info. you need (due to the way Windows works, it's pretty tough to
audit this stuff properly).

One solution is logon and logoff scripts that write to a database somewhere.
You can then build logic into reports, etc. for incidents whereby a user
logs on from the same computer twice but there's no logoff event (because
they hibernated or went into standby).

LimitLogon has done much of this for you. You can, I am sure (although I've
not tried), tweak this so that it just reports and doesn't actually limit
logons, etc. It's a free download from Microsoft (it's a resource kit add
on).
 
Paul said:
You can do this via the event logs, but it's a major pain in the ass. You'd
be better off implementing your own solution, as the event logs won't cater
for unexpected shutdowns, disconnections, etc. and are also sadly lacking in
the exact info. you need (due to the way Windows works, it's pretty tough to
audit this stuff properly).

One solution is logon and logoff scripts that write to a database somewhere.
You can then build logic into reports, etc. for incidents whereby a user
logs on from the same computer twice but there's no logoff event (because
they hibernated or went into standby).

LimitLogon has done much of this for you. You can, I am sure (although I've
not tried), tweak this so that it just reports and doesn't actually limit
logons, etc. It's a free download from Microsoft (it's a resource kit add
on).
Click to expand...

I implemented my own scripts to handle what LimitLogon does now since MS
was too stupid to prevent concurrent logons out of the box and so at
the time LimitLogon was not available to me. I never integrated my
scripts into a DB or anything to keep track of when the logoffs occur
since HP OpenView is being used. However the environment at work is a
hybrid HP-UX/Windows environment and so that is why that situation was
possible.
 
Hmmm...I'd be very interested in further discussing how you implemented this
with OVOW. Any chance we can take this off line and further discuss?
 
Paul said:
Hmmm...I'd be very interested in further discussing how you implemented this
with OVOW. Any chance we can take this off line and further discuss?
Click to expand...


Well, I can tell you some things but not everything and probably not
enough to warrant an offline discussion. I work on a development
contract for the US gov't and the people who actually setup OVO are on
another Operations-related contract. I can tell you what I know now and
if you want to know more I can try to ask at work and then get back to you.

We have multiple SuperDomes and Windows servers installed. The OVO
manager is on one of the partitions in one of the Domes. The "basic"
Windows SPI was purchased for all the Windows servers and was tied into
OVO. I've never used OVO myself and can't tell you any technical
details (only because I don't know; not due to secrecy issues) about
what needed to be done to make it all work. But this had to be done due
to security requirements regarding realtime monitoring. From what I
remembered reading on HP's site the SPIs for Windows are capable of
monitoring the Windows event logs as well as give other stats (although
I'd guess that ultimately depends on which type of SPI you purchase).
I'm not even sure if the Windows SPIs are completely configured yet
since they were only purchased about 6 weeks ago. Does any of that help?
 
Back
Top