User auditing in Windows Server 2003?

September 16, 2007 8:15 PM

Is there a way (or 3rd party application) to have Windows Server 2003 keep track of the number of logins in a computer lab?

I work in a high school and manage 4 computer labs. Currently we have a workstation in each lab running filemaker pro that drop-in students sign in on before they sit down at a computer. In the middle of each year we can output the numbers and graph them and do all sorts of things to analyze the lab usage. This mostly works but many students fall through the cracks plus it's also a hassle on our parts and the students to constantly remind students to sign in. It's inefficient.

We are using Windows Server 2003 and I was wondering if anybody knows a way to keep logs of the logins in the labs that we can easily output and then drop into graphs to analyze the usage of the labs. I'm not sure if user auditing would help us here becuase we aren't really interested in the details so much as the numbers over (specific) time (i.e. a month or two or the entire year).

Does anybody know if Server 2003 can do this or if there is a 3rd party application that does this.

posted by crios to computers & internet (5 comments total)

You could use Log Parser and dump the event logs of your server, or each client, to a SQL database then you can query out pretty much any information you want... logins, prints, errors, etc.
posted by mattdini at 8:21 PM on September 16, 2007

There is lots you can do with login scripts and network shares. For example it would be fairly straight forward to have a script append the date, time, workstation name, login username to a comma delimited text file on a network share. You can even have the script on the server so that changes can be made instantly for all machines. Once you have the CSV file of login information you can analyze to your hearts content in Excel.

You could do the same with a logoff script to log duration of use but the data will be inaccurate because a certain percentage of users will just turn the machine off instead of logging off plus when the machine crashes it won't run the logout script.
posted by Mitheral at 9:12 PM on September 16, 2007

I've found a simple answer in using a logon script tool like kixtart to process the scripts. It can write events to the event viewer and there is a GUI tool that allows you to do a lot without actually understanding the scripting side.

You'd then use log parser to pull those events that matter -i.e. based on machine name or username, as mattdini suggests, or have the events dumped to a CSV file as Mitheral suggests. But kixtart sure makes it simple (and there is a large script archive available to learn from).
posted by disclaimer at 5:19 AM on September 17, 2007

We're not really interested in events. We're really interested in numbers. Can we create a script that will just count how many students logged in during specified time periods in specified places?
posted by crios at 3:18 PM on September 17, 2007

OK here is a basic off the top of my head proccess. It logs every login rather than incrementing a counter because it's easier (IE: I'd have to expend actual brain sweat to figure it out. If you're interested start with MS). Besides once you start tracking logins you'll find all sorts of useful things to do with the data. This doesn't include any error checking and is using a simple bat file:

Create a network share. Set the NTFS permissions to everyone write but not read (there is a bit of a privacy issue with this data). Append a $ to the end of the share name so it can't be browsed for. Lets say the network share UNC is:
\\CriosServer2003\Logs$

Create a batch file. Let's call it log.bat

Edit log.bat and paste in this string all on the same line:
echo %date%,%time%,%computername%,%username%>>\\CriosServer2003\Logs$\log.csv
Save the bat.

Run the bat a few times, then open log.csv. You should see something like:

2007-09-17,17:19:06.93,CriosWorkStation,Crios
2007-09-17,17:19:19.79,CriosWorkStation,Crios
2007-09-17,17:19:25.58,CriosWorkStation,Crios

Now you just have to push the script out to the clients that you want to track and configure it so that it runs at every logon. The easiest way to do this is if you are running Active Directory and your lab machines are in their own OU. If the above is true then you can set a group policy on the OU to run the above logon script. You'll need to put the script somewhere everyone can read it.

If you aren't running active directory then you can just copy the script into the start up group of your lab machines. Or execute the bat from one of the run keys in the registry.

Again this isn't necessarily the best way of doing this but it should work.

log.text can be opened with Excel or Access or even a text editor. Note pad will tell you how many lines there are in the file. # of lines = # of logins.

I'd setup a cron job to archive log.text everyday. Both to reduce server load and to keep things a bit more secure.

PS: I haven't tested this, I don't even have access to a XP box so use this at your own risk. A bit of testing would be prudent.
posted by Mitheral at 5:54 PM on September 17, 2007