Kaseya Community

Capture Server Logon / Logoff Information

  • Hi folks,

    Trying to create a method to capture the users who logon / logoff from a server. Idea is to report on this every month for the client - who logged on and when they logged off.

    I have looked a few methods such as GPO policies but they can only be applied to users unless I use loopback and not keen + I cannot automate from kaseya.

    I don't want to use security logs as they are ugly and I don't want to capture them.

    So what I was thinking was someway to monitor the presence of explorer.exe as this will only exist if a user is logged in and also it will exist for that user in the case of RDP sessions. So the idea was create a service to monitor for explorer.exe then once spotted capture username and time and log to file when it disappears for that user log the time it disappeared.

    Now this idea is very much that just a concept so I am looking for either ways people think this could be achieved or if people have another much simpler way to track this information.

    Kaseya agent was supposed to be able to do it but rubbish as it is based on the kasusrtsk.exe so no good.

    Thanks in advance.

    Michael

    Legacy Forum Name: Capture Server Logon / Logoff Information,
    Legacy Posted By Username: mmartin
  • Maybe I'm missing something here, but checking for two events in the security log is ugly, but using a service to check for instances of explorer.exe is elegant? Eek

    Also,

    runas /user: "explorer.exe /separate"


    will break your proposed method.

    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: sequoya