Or maybe some way to check if logged on with cached credentials? Maybe checking for an event with logon type 11 might be a way forward here I'm thinking
---Blackberried -----Original Message----- From: "Crawford, Scott" <crawfo...@evangel.edu> Date: Wed, 15 Aug 2012 20:59:11 To: NT System Admin Issues<ntsysadmin@lyris.sunbelt-software.com> Reply-To: "NT System Admin Issues" <ntsysadmin@lyris.sunbelt-software.com>Subject: RE: Offline/online detection The problem is that it's hard to define "logged on". You don't really log on to the network. You log on to a *computer* by authenticating against a domain controller. You probably want some way to check if you're connected to a network and can reach a domain controller. -----Original Message----- From: Rankin, James R [mailto:kz2...@googlemail.com] Sent: Wednesday, August 15, 2012 2:09 PM To: NT System Admin Issues Subject: Re: Offline/online detection What I am looking for is something - file, variable, reg key, etc. - that would indicate a computer wasn't (or was) logged on to the corporate network. You could use some sort of ping, but that would be no good if ping was blocked or the target that determines the "online" status was offline or unreachable for some reason. Hope I am making sense here, I am watching the England game as well as emailing away :-) ---Blackberried -----Original Message----- From: "Kennedy, Jim" <kennedy...@elyriaschools.org> Date: Wed, 15 Aug 2012 18:45:51 To: NT System Admin Issues<ntsysadmin@lyris.sunbelt-software.com> Reply-To: "NT System Admin Issues" <ntsysadmin@lyris.sunbelt-software.com>Subject: RE: Offline/online detection Not sure if this is what you are asking but I track logons with a logon script that writes to a csv file on a server share. You could modify it a bit and add a second script to track logoffs. It is the only thing I have found to be reliable. Then I have a scheduled task each night to rename 'log.csv' to today's date and recreate a new 'log.csv' for the next day. It gives me computername, username, ip and time. WARNING, very bad things happen if the server share becomes unavailable using my system. I would suggest using a couple of server shares and dfs them for fail over. strComputer = objNetwork.ComputerName Set objWMIService = GetObject( _ "winmgmts:\\" & strComputer & "\root\cimv2") Set IPConfigSet = objWMIService.ExecQuery _ ("Select IPAddress from Win32_NetworkAdapterConfiguration ") For Each IPConfig in IPConfigSet If Not IsNull(IPConfig.IPAddress) Then For i=LBound(IPConfig.IPAddress) _ to UBound(IPConfig.IPAddress) strIPAddress = strIPAddress & "," & IpConfig.IpAddress(i) Next End If Next strInfo = objNetwork.ComputerName & "," & objNetwork.UserName & "," & Date() & "," & Time() & "," & StrIPAddress SET objFSO = CreateObject("Scripting.FileSystemObject") SET objOutputFile = objFSO.OpenTextFile("\\SERVER\Logs\log.csv", ForAppend, False) objOutputfile.writeline strInfo objFSO.Close -----Original Message----- From: Rankin, James R [mailto:kz2...@googlemail.com] Sent: Wednesday, August 15, 2012 2:28 PM To: NT System Admin Issues Subject: Offline/online detection What's the best way to detect whether a user is offline or online (I.e. Connected to the corporate network)? I thought maybe query the %logonserver% variable but that might also apply to online situations where a DC cannot be contacted for whatever reason. I'm sure there must be a way, wondering if anyone has any ideas they can throw out? TIA, JR ---Blackberried ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
