Kaseya Community

Run Procedure on Logon with multiple users

  • This one is a little different than the other threads.  In my case I have computers with multiple users and I need a process to run on the first logon of each user.  The "If isUserLoggedIn" procedure doesn't work in this case.  For most of my computers it's a single user but there's about 25% that has 2+ users who log in to the same computer.

    I basically have to copy a folder with a couple of sub directories in it and a few files and then execute a EXE in the root folder.  If I have to I can figure out a way to do this through a GPO but for tracking purposes Kaseya would be a nicer option.

  • Can you not copy the folder to the public desktop and execute with when the user logs in?

  • We need this to be a non-user interactive process.  So I can copy the folder to C:\Temp but I need the procedure to run the EXE from the root of the copied folder with no user interaction and on each user that logs in to the machine.

  • So you want the procedure to run everytime the a different user logs in? or just run one time?

  • Each time a different user logs in.  It just needs to run once to update OneDrive to point to the user's local OneDrive folder.  

  • ok, what I would do is call your exe from the startup folder(shortcut to the exe in temp folder) and add a step in the procedure so that once it runs, it creates a text file in their downloads folder and have the procedure check that download folder each time it runs. If it exist, don't run the procedure again for that user. If it does not exist, run the procedure for that user. Thoughts?

  • The other option is to use RunOnce Registry key and write it to the registry of the machine. The regkey would point to the location of the EXE and it will run once for every user who logs onto the machine.

  • I had a technical situation where I needed to fire off a script when a user logged in.  I utilized event monitoring when a user logged in and script was kicked off.

    I believe the eventid is: • Logon – 4624 (An account was successfully logged on)

  • Unfortunately RunOnce won't work since it's standard users logging in.  I spent most of yesterday beating my head against the desk trying to figure out why it wasn't working.  https://support.microsoft.com/en-us/help/2021405/standard-user-runonce-and-runonceex-are-not-being-executed

    The event monitoring may be my solution, unfortunately it would require me to write a GPO to get the logon monitoring turned on.  

    Having Kaseya check for a file in a user folder may be my option.  I probably won't use Downloads since if someone clears that folder out the procedure may re-run but at least it gives me a good starting point.

    added Microsoft url
    [edited by: trevor.okazaki at 8:10 AM (GMT -8) on Jan 25, 2018]
  • It looks like this is going to be part of my solution.  The only minor issue is that my procedure writes a txt file to %UserProfile%\My Videos\ and that puts it in the C:\users\[username]\Videos folder as opposed to the D:\Data\[username]\OneDrive\Videos folder that is linked to the user account.  Realistically it's a pretty insignificant issue since the file is only going to be there as a if/then check.  The next step is to get the monitoring to check for the file.

    Now I may be able to write a procedure for another setup option instead of a GPO.  The GPO is a bit messy and seems to run each time the user logs in and I don't need it to do that.

    [edited by: trevor.okazaki at 9:39 AM (GMT -8) on Jan 25, 2018]
  • This looks like what I need to do since I need it to run for each user that logs in to a computer.  I'd say 80% of our users use individual machines but it's that 20% that share machines that become a problem.

    I'm having an issue with the Kaseya Monitor actually doing what it's supposed to.  I created a Event Log Alert with the log type Security looking for a Success Audit with an Event Set of Source Filter: Security, Category Filter: Logon, Event ID 4624.  I set the Alert  to occur 1 time in 10 minutes and my alert action is to run my saved procedure.

    I can run the procedure when a user is logged in and it works perfectly.  I just can't it to work so it's actually checking the Event Log for the 4624 event.

  • Completely unrelated to Kaseya, but I can say that what i've done in a similar case in the past is to add my scripted installer to the startup folder in the start menu (or whatever you want to call it these days :) ), wrapped inside a batch file that basically first checks for the existance of a file in their userprofile folder, and immediately exits if that file is there.  Then the final step of the batch file is to create that file in their userprofile after the install is complete.

    From the Kaseya side to check for the event log collection configurations for the clients.  I've recently seen some chatter saying that if you have *any* event log collection going on, then you have to make sure you are collecting for the specific types of events that you are monitoring for.

  • I was part of the recent "chatter" on event log monitoring :-)    Apparently if you want to alert on event log entries, you need collection of events from that log to be all or none.  We were collecting failure messages only for the Security Log and our alert for event 4740 Success would not fire.  Our choice to get the alert working was to collect all Security Log entries or none.   So, if the 4624 alert issue is that your script is not being triggered, try disabling event log collection.

  • From what I saw in one of the Kaseya Tech videos on YouTube from version 9.3 you don't need to collect Windows Event in the Agent for Monitoring Alerts to work.  Apparently it's especially critical for the some of the Event Logs since they'll generate a ton of entries pretty quickly and slow down SQL.


    My solution was to wildcard everything but the event ID.  Doing that seemed to work but I've only tested it with one test user so far so I need to expand my testing to confirm that it'll work that way.

  • From one of the Kaseya TechJam videos on YouTube (https://youtu.be/SRx2mW_T_e0) as of 6.3 you don't need to have the Agent Log collection running for the Monitoring to work.

    I wildcarded everything in my Event Monitor except the event ID 4624 and it's worked in two test instances.