#178640 - 2007-08-02 05:07 PM
TSE, GPO and environment variables
|
ChristopheM
Hey THIS is FUN
Registered: 2002-05-13
Posts: 311
Loc: STRASBOURG, France
|
Hi,
first, sorry for my english.
my director wants statistics on power on - power off - connection and disconnection on workstation and servers.
because event log are too complex to analyze, i have written a kix script to write information in a local text file for each action and published it with gpo (the script is copied locally) to be found even if users are working on a laptop and are not connected to the network. I use environment variables (%computername%, %clientname%, %sessionname%", etc...).
the problem began when one user has several remote and concurrent sessions on the same computer (OK, this is not a common situation but it can happen). Here is example of log :
MyServer;MyDomain;SYSTEM;MyDomain;2007/08/02;15:00:00;MyServer;START;;;;
MyServer;MyDomain;MyUserID;MyDomain;2007/08/02;15:37:54;MyServer;CONNECT;Console;;;
MyServer;MyDomain;MyUserID;MyDomain;2007/08/02;15:38:35;WRK1;CONNECT;RDP-Tcp#4;;;
MyServer;MyDomain;MyUserID;MyDomain;2007/08/02;15:39:10;WRK2;CONNECT;RDP-Tcp#5;;;
now, if i close the console session, i should have something like that : MyServer;MyDomain;MyUserID;MyDomain;2007/08/02;15:45:00;MyServer;DISCONNECT;Console;2007/08/02;15:37:54
In fact, I have : MyServer;MyDomain;MyUserID;MyDomain;2007/08/02;15:39:45;WRK2;DISCONNECT;RDP-Tcp#5;2007/08/02;15:39:10;
and when i close the two remaining sessions, i have : MyServer;MyDomain;MyUserID;MyDomain;2007/08/02;15:40:15;WRK2;DISCONNECT;RDP-Tcp#5;;;
MyServer;MyDomain;MyUserID;MyDomain;2007/08/02;15:40:39;WRK2;DISCONNECT;RDP-Tcp#5;;;
the content of %sessionname% and %clientname% in session 1 and 2 has benn overriden by content of session 3 !!!
to be sure of that, i have opened 3 sessions on a server :
- the first, i connect on the console on my server
- second, i start a remote session from workstation 1 on my server.
On the remote session, i start a cmd and keep at screen the result of set command. Then, i kill all user processes (explorer, taskmgr, etc..) except the cmd. - third, i start a new remote session from workstation 2 on my server.
- fourth, on workstation 1, i restart a taskmgr, launch a new cmd and type set. The result is not the same than in the first cmd window !!!
%sessionname% and %clientname% have now the values of the latest session (on workstation 2)
am i doing something wrong or is it a very big bug of TSE session ?
Has somebody a solution to keep right informations in a session ?
_________________________
Christophe
|
|
Top
|
|
|
|
|
#178679 - 2007-08-03 01:12 PM
Re: TSE, GPO and environment variables
[Re: Sealeopard]
|
ChristopheM
Hey THIS is FUN
Registered: 2002-05-13
Posts: 311
Loc: STRASBOURG, France
|
1) too many informations in the event log and sometimes, not the good information.
in the security event log, each connection adds several events (connect, disconnect) and a disconnection doesn't give information about the corresponding connection event !!!
2) I have 3900 workstations and about 120 servers to manage.
usually, users shutdown workstations before leaving the office (but not all) so i can't have a batch that wake up workstations to collect event log every night. I need to have global informations quickly, I can't query dynamically workstations because many workstations aren't powered on every day and it would be too long.
with the script i have written, i have delimited text file in a local cache (one file per day) and theses files are copied to a centralized directory on a server each time an action happens (and the network is available). The script is not very long (no more than 700 lines with comments), execution is very quick and informations are available immediately. The problem just happens if one user has several sessions on the same remote host !!!
I had a look at wtsmanager.dll but i can't get interesting informations about the current session.
PS : Now, it's time for holidays. i will be back on two weeks
Edited by Christophe Melin (2007-08-04 10:32 AM)
_________________________
Christophe
|
|
Top
|
|
|
|
Moderator: Shawn, ShaneEP, Ruud van Velsen, Arend_, Jochen, Radimus, Glenn Barnas, Allen, Mart
|
0 registered
and 1527 anonymous users online.
|
|
|
