1) too many informations in the event log and sometimes, not the good information.
in the security event log, each connection adds several events (connect, disconnect) and a disconnection doesn't give information about the corresponding connection event !!!
2) I have 3900 workstations and about 120 servers to manage.
usually, users shutdown workstations before leaving the office (but not all) so i can't have a batch that wake up workstations to collect event log every night. I need to have global informations quickly, I can't query dynamically workstations because many workstations aren't powered on every day and it would be too long.
with the script i have written, i have delimited text file in a local cache (one file per day) and theses files are copied to a centralized directory on a server each time an action happens (and the network is available). The script is not very long (no more than 700 lines with comments), execution is very quick and informations are available immediately. The problem just happens if one user has several sessions on the same remote host !!!
I had a look at wtsmanager.dll but i can't get interesting informations about the current session.
PS : Now, it's time for holidays. i will be back on two weeks
Edited by Christophe Melin (2007-08-04 10:32 AM)
_________________________
Christophe
