User login auditing

Forums

My Profile

Inbox

Address Book

My Subscription

My Forums

User login auditing

Logged in as: Guest

arrSession:exec spGetSession 2,16,30261

	Active Users: There are 0 members and 0 guests.
	Users viewing this topic: none

Printable Version

All Forums >> [Scripting] >> Post a VBScript >> User login auditing
Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks!

Page: [1]

Message

<< Older Topic Newer Topic >>

User login auditing - 1/25/2006 3:27:29 AM

kirrilian

Posts: 628
Score: 3
Joined: 3/15/2005
From:
Status: offline

I wrote this script to audit logins to our terminal services server.

NOTE: this script has been "publified" this means you will have to change what would normally be private info such as mail server names, email addys etc.

'==========================================================================
'
' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 4.0
'
' NAME: ts_login_checker.vbs
'
' AUTHOR:  Kirrilian
' DATE  : 1/25/2006
'
' COMMENT: This script will check the event logs for logins and compile those
'            into a summary and detailed report for daily, weekly and monthly
'            then email it to you, as well as saving it in a local csv file.
'            Put this script on the server you want to monitor, don't forget to
'            change the email address as needed.
'
'==========================================================================

'On Error Resume Next
Dim dictCount,failedCount, successfulCount,sDate, eDate,reportType
dictCount = 1
failedCount = 0
successfulCount = 0

Set objDictionary1 = CreateObject("Scripting.Dictionary") 'successful logins
Set objDictionary2 = CreateObject("Scripting.Dictionary") 'failed logins
Set objDictionary3 = CreateObject("Scripting.Dictionary") 'detailed output

Set wshshell = CreateObject("wscript.shell")

'the output file has to have the full path in order for the CDO object to attach it to an email
myDate = Replace(Date, "/", "") & "@" & Left(Replace(Time, ":", ""), 3) & Right(Time, 2)
outputfile = wshshell.CurrentDirectory & "\tsusers_" & myDate & ".csv"

'add header to dictionary
objDictionary3.Add dictcount, "computer,type,code,username,source,date/time"
dictcount = dictcount + 1

getData "cm-sas-ts-01"

detail = outputDict3()
summary = outputSummary()

'output the summary
printOut detail
'dont include the summary in the output file
WScript.echo summary

emailBody = summary &vbNewLine & "Check the attachment for the detailed output"

'change the email addresses!
sendEmail "Kirrilian@work.com","Kirrilian@work.com",reportType & " TS Login Report",emailBody,outputfile

Sub getData(strComputer)
   Dim today, dayname, prevmo, prevweek
   
   'for monthly report, if = 1
   today = Day(Now())
   'for weekly report if = Sun
   dayname = WeekdayName(Weekday(Now()),true)
   
   'ending date is always today!
   tomorrow = DateAdd("d", 1, Date())
   eDate = Year(Now()) & Right("0" & Month(Now()), 2) & Right("00" & Day(tomorrow), 2) & "000000.000000-300"
   
   'set query dates by report type
   'damn ugly wmi date
   If today = 1 Then
       'set monthly
       prevmo = DateAdd("mm", -1, Date())
       sDate = Year(prevmo) & Right("0" & Month(prevmo), 2) & Right("00" & Day(prevmo), 2) & "000000.000000-300"
       reportType = "Monthly"
   Elseif dayname = "Sun" then
       'set weekly
       prevweek = DateAdd("ww", -1, Date())
       sDate = Year(prevweek) & Right("0" & Month(prevweek), 2) & Right("00" & Day(prevweek), 2) & "000000.000000-300"
       reportType = "Weekly"
   Else
       'set daily
       sDate = Year(Now()) & Right("0" & Month(Now()), 2) & Right("00" & Day(Now()), 2) & "000000.000000-300"
       reportType = "Daily"
   End If

'failure audit = 560
   'successful login/logoff = 528
   'successful rpc login = 540
   'unknown username/pw = 529
   errCodes = Array("529","528","540")
   For Each code In errCodes
       Set objWMIService = GetObject("winmgmts:" _
           & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
       Set colLoggedEvents = objWMIService.ExecQuery _
           ("Select * from Win32_NTLogEvent where Logfile = 'security' And EventCode = '" & code & "'" _
           & " And TimeWritten >= '" & sDate & "' And TimeWritten <= '" & eDate & "'")
       If colLoggedEvents.count = 0 Then
           'WScript.Echo "There were no hits for code " & code
       Else
           For Each objEvent in colLoggedEvents
                msgArray = Split(objEvent.Message, VbCrLf)
               Select Case code
                   Case "529" 'failed logins
                       failedCount = failedCount + 1
                       username = msgArray(4)
                       addr = msgArray(26)
                       domain = msgArray(6)
                       username = lcase(Trim(Replace(username,vbTab & "User Name:"& vbTab,"")))
                       addr = Trim(Replace(addr,vbTab & "Source Network Address:" & vbTab,""))
                       'add to detailed output
                       add2dict3 strComputer & ",failed," & code & "," & username & "," & addr & "," & WMIDateStringToDate(objEvent.TimeWritten)
                       'add to summary count by username
                       If objDictionary2.Exists(username) Then
                           objDictionary2.Item(username) = objDictionary2.Item(username) + 1
                       Else
                           objDictionary2.Add username, "1"
                       End If
                   Case "528" 'successful logins
                       username = msgArray(2)
                       addr = msgArray(28)
                       username = lcase(objEvent.User)
                       addr = Trim(Replace(addr,vbTab & "Source Network Address:" & vbTab,""))
                       If Not (username = "nt authority\network service" Or username = "nt authority\local service") Then
                           successfulCount = successfulCount + 1
                           add2dict3 strComputer & ",successful,"  & code & "," & username & "," & addr & "," & WMIDateStringToDate(objEvent.TimeWritten)
                           If objDictionary1.Exists(username) Then
                               objDictionary1.Item(username) = objDictionary1.Item(username) + 1
                           Else
                               objDictionary1.Add username, "1"
                           End If
                       End If
                   Case "540" 'successful logins
                       username = msgArray(2)
                       addr = msgArray(28)
                       username = lcase(objEvent.User)
                       addr = Trim(Replace(addr,vbTab & "Source Network Address:" & vbTab,""))
                       If Not (username = "nt authority\anonymous logon" Or username = "nt authority\system") Then
                           successfulCount = successfulCount + 1
                           add2dict3 strComputer & ",successful,"  & code & "," & username & "," & addr & "," & WMIDateStringToDate(objEvent.TimeWritten)
                           If objDictionary1.Exists(username) Then
                               objDictionary1.Item(username) = objDictionary1.Item(username) + 1
                           Else
                               objDictionary1.Add username, "1"
                           End If
                       End If
               End Select
           Next
       End If
   Next
End Sub

'taken from the script repository
Function WMIDateStringToDate(dtmInstallDate)
   WMIDateStringToDate = CDate(Mid(dtmInstallDate, 5, 2) & "/" & _
       Mid(dtmInstallDate, 7, 2) & "/" & Left(dtmInstallDate, 4) _
           & " " & Mid (dtmInstallDate, 9, 2) & ":" & _
               Mid(dtmInstallDate, 11, 2) & ":" & Mid(dtmInstallDate, _
                   13, 2))
End Function

Sub add2dict3(item)
   objDictionary3.Add dictcount, item
   dictcount = dictcount + 1
End Sub

function outputDict3()
   For Each obj In objDictionary3
       temp = temp & objDictionary3(obj) & vbnewline
   Next
   outputDict3 = temp
End function 'outputArray

function outputSummary()
   If objDictionary1.Count = 0 Then
       sucUsers = "There were no successful logins." & vbNewLine
   Else
       For Each obj1 In objDictionary1
           'concatenate the output for successful users
           sucUsers = sucUsers & Left(obj1 & Space(30), 30) & vbTab & objDictionary1(obj1) & vbNewLine
       Next
   End If
   If objDictionary2.Count = 0 Then
       failUsers = "There were no failed logins." & vbNewLine
   Else
       For Each obj2 In objDictionary2
           'concatenate the output for failed logins
           failUsers = failUsers & Left(obj2 & Space(30), 30) & vbTab & objDictionary2(obj2) & vbNewLine
       Next
   End If
   outputSummary = vbNewLine & "*********** " & reportType & " Executive Summary **********" & vbNewLine & vbNewLine _
       & "Query dates from: " & WMIDateStringToDate(sDate) & " to: " & WMIDateStringToDate(eDate) & vbNewLine _
   & "Total number of successful logins: " & successfulCount & vbNewLine _
   & "Total number of failed logins: " & failedCount & vbNewLine _
   & "See the detailed report for specifics." & vbNewLine & vbnewline _
   & "Users that have successfully logged in:" & vbNewLine & sucUsers & vbNewLine _
   & "Users that have failed to login:" & vbNewLine & failUsers & vbNewLine _
   & "*********** Executive Summary End **********" & vbNewLine 
End function

Sub sendEmail(sentfrom, sendto, subject, textBody, attachment)
   Set objMessage = CreateObject("CDO.Message")
   objMessage.Subject = subject
   objMessage.Sender = sentfrom
   objMessage.To = sendTo
   objMessage.Cc = SendToCC
   objMessage.TextBody = TextBody
   objMessage.AddAttachment Attachment 'attach the output file
   'objMessage.AddAttachment outputAttachment1 'attach the no acct file

'==This section provides the configuration information for the remote SMTP server.
   '==Normally you will only change the server name or IP.

objMessage.Configuration.Fields.Item _
   ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
   
   'Name Or IP of Remote SMTP Server
   objMessage.Configuration.Fields.Item _
   ("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "mail.someco.com"

'Server port (typically 25)
   objMessage.Configuration.Fields.Item _
   ("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25

objMessage.Configuration.Fields.Update

'==End remote SMTP server configuration section==

objMessage.Send

WScript.Echo "Email Sent"
End sub 'sendEmail

Sub printOut(prefix,data)    
   Set fso = CreateObject("Scripting.FileSystemObject")
   'appends to the file
   Set txtStreamOut = fso.OpenTextFile(outputfile, 8, True)
   WScript.Echo data
   txtStreamOut.writeline data
   Set fso = Nothing
   Set txtStreamOut = Nothing
   Set txtStreamErrOut = nothing
End Sub 'printOut

_____________________________

Have you searched here ?
VBScript Fundamentals
My Site

Post #: 1

RE: User login auditing - 3/7/2006 12:18:35 AM

Exin

Posts: 1
Score: 0
Joined: 3/7/2006
Status: offline

I wanted to use this script for my ts servers but all I get is an error:Wrong number of arguments or invalid property assignment: 'printout" code:800A01c2
What do I do wrong?

(in reply to kirrilian)

Post #: 2

RE: User login auditing - 3/7/2006 6:40:12 AM

ebgreen

Posts: 4613
Score: 31
Joined: 7/12/2005
Status: offline

I would recommend creating a new thread in the WSH & Client Side VBScript forum. Post the code that you are actually running, the exact error that you are getting and the line tht the error occurs on.

_____________________________

"... when you are good and crazy, oooh, oooh, oooh, the sky is the limit!" - The Tick
Goog places to start:http://www.visualbasicscript.com/m_24727/tm.htm
http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to Exin)