Monitoring usage of Windows PCs in a networked environment

[vanHunks]

I need to obtain sessions statistics (user id, start date/time-stamp, end date/time-stamp) for a fixed group of PCs connected to a Microsoft-products managed network. I've been pressing our IS people whose initial solution was to collect and store the relevant records in the Event Logs of the PCs but this has not been successful (big surprise !). I would have thought Active Directory is a better source of such information but our IS people are either too lazy or too ignorant to produce a good AD-based solution.

If anyone has a suggestion for using AD in this role, without requiring an additional software package then I would be grateful if you could share it with me - am rather at my wit's end on this. A solution based on something else entirely would also be welcome.

 

[Wyzak]

We are using the IP accounting feature of a Mikrotik routerboard to monitor Internet usage.

 

[Pada]

I was also going to suggest MikroTik's IP accounting for that.

Just take note that then you will only be tracking it according to source & destination IP addresses.
The information that you can get is:

# 	SRC-ADDRESS 	DST-ADDRESS 	PACKETS 	BYTES 	SRC-USER 	DST-USER
0 	192.168.0.2 	159.148.172.197	474 		19130
1 	192.168.0.2 	10.0.0.4	3 		120
2 	192.168.0.2 	192.150.20.254	32 		3142
3 	192.150.20.254 	192.168.0.2	26 		2857
4 	10.0.0.4 	192.168.0.2	2		117
5 	159.148.147.196	192.168.0.2	2		136
6 	192.168.0.2	159.148.147.196	1		40
7 	159.148.172.197	192.168.0.2	835 		1192962

So if you pull the stats on a 1 minute interval, you can get pretty accurate time based stats too.

I have no idea what kind of session based stats you want...

Usually session based stuff would imply (http/https) packet inspection, which is illegal if I'm not mistaken - unless the users has signed an indemnity form that you may do that?!

 

[vanHunks]

As mentioned, all I want is a record of login id, login time and logout time, for example :

Johan 2012.06.14:11.37.05 2012.06.14:12.13.23

or even

Johan LOGIN 2012.06.14:11.37.05
Johan LOGOUT 2012.06.14:12.13.23

I think the source is more likely to be the authorization / security system than a network-monitoring tool; surely Active Directory could be persuaded to produce such a simple record - here's hoping.

 

[PallBearer]

there is the islog located on the c:\ or you could create a section in the login script to update a file on the server.
rather simple.