Topic: Logging or Auditing Users as they Logon and Logoff

[sonoracomm]

Does anyone have a good method to log users' network activity?

Specifically, we want to use this info with, or in liu of a punch clock.  The owner wants an easy way to track when users logon and logout of the network.  Most clients are Windows 2000 Pro.

I have experimented with preexec and postexec in smb.conf, but it looks like Windows is very unpredictable about when it accesses and releases a share.  I've experimented with various shares without useful results.

I experimented a bit with the utmp option and the 'last' command.  That seemed a bit more useful except for two problems.  How to set the deadtime option (it is 10080 by default) and how to parse or use the utmp info.  Why is the deadtime set to 10080?  (I don't want to break something.)

I would welcome any comments as to the best way to 'get there from here'.

Thanks in advance,

G

[matsk]

The posting moved by the author to:
http://sme.4gurus.org/modules/newbb/viewforum.php?forum=3

[sonoracomm]

That's surely a reasonable idea...

However, it only helps with logons, not logoffs.  It's the logoff part that really seems hard.

Thanks much,

G

[matsk]

The posting moved by the author to:
http://sme.4gurus.org/modules/newbb/viewforum.php?forum=3

[Franco]

What was the end result of this thread? I'm looking for the exact same thing!
Anyone have any ideas on how should I implement ways to track users login in and out?

Thanks,

[sonoracomm]

I gave up.  I still need this.

It seems that the log IN part is easy.  However Windows seems to somewhat arbitrarily log in and logout whenever it wants during the session.

G

[CharlieBrady]

That's surely a reasonable idea...

Whatever the idea was. It seems the author has taken the idea away. That seems rather un-generous.

[CharlieBrady]

However Windows seems to somewhat arbitrarily log in and logout whenever it wants during the session.

AIUI, that's part of the definition of the SMB protocol. Sessions are re-established as required.

[sonoracomm]

One thing I seem to remember about this, and I may be wrong, is that MS had added a new capability to XP (SP2?) where you can control logoff behavior, maybe using a GPO.

Unfortunately, this didn't help me much because the vast majority of my customers have followed my advice to use Windows 2000 Pro instead of XP Pro.

I would still love a solution to this though...

G

[Franco]

I'm looking at some options and as soon as I come up with something I'll be glad to share. I'm on the same boat where older systems need to apply!