Hi,

first, sorry for my english.

my director wants statistics on power on - power off - connection and disconnection on workstation and servers.
because event log are too complex to analyze, i have written a kix script to write information in a local text file for each action and published it with gpo (the script is copied locally) to be found even if users are working on a laptop and are not connected to the network. I use environment variables (%computername%, %clientname%, %sessionname%", etc...).

the problem began when one user has several remote and concurrent sessions on the same computer (OK, this is not a common situation but it can happen). Here is example of log :
 Code:
MyServer;MyDomain;SYSTEM;MyDomain;2007/08/02;15:00:00;MyServer;START;;;;
MyServer;MyDomain;MyUserID;MyDomain;2007/08/02;15:37:54;MyServer;CONNECT;Console;;;
MyServer;MyDomain;MyUserID;MyDomain;2007/08/02;15:38:35;WRK1;CONNECT;RDP-Tcp#4;;;
MyServer;MyDomain;MyUserID;MyDomain;2007/08/02;15:39:10;WRK2;CONNECT;RDP-Tcp#5;;;


now, if i close the console session, i should have something like that :
 Code:
MyServer;MyDomain;MyUserID;MyDomain;2007/08/02;15:45:00;MyServer;DISCONNECT;Console;2007/08/02;15:37:54

In fact, I have :
 Code:
MyServer;MyDomain;MyUserID;MyDomain;2007/08/02;15:39:45;WRK2;DISCONNECT;RDP-Tcp#5;2007/08/02;15:39:10;


and when i close the two remaining sessions, i have :
 Code:
MyServer;MyDomain;MyUserID;MyDomain;2007/08/02;15:40:15;WRK2;DISCONNECT;RDP-Tcp#5;;;
MyServer;MyDomain;MyUserID;MyDomain;2007/08/02;15:40:39;WRK2;DISCONNECT;RDP-Tcp#5;;;


the content of %sessionname% and %clientname% in session 1 and 2 has benn overriden by content of session 3 !!!

to be sure of that, i have opened 3 sessions on a server :

  • the first, i connect on the console on my server
  • second, i start a remote session from workstation 1 on my server.
    On the remote session, i start a cmd and keep at screen the result of set command. Then, i kill all user processes (explorer, taskmgr, etc..) except the cmd.
  • third, i start a new remote session from workstation 2 on my server.
  • fourth, on workstation 1, i restart a taskmgr, launch a new cmd and type set. The result is not the same than in the first cmd window !!!
    %sessionname% and %clientname% have now the values of the latest session (on workstation 2)

am i doing something wrong or is it a very big bug of TSE session ?

Has somebody a solution to keep right informations in a session ?
_________________________
Christophe