PC/User Audits 1

[kachbo1]

Hi,

I have a list of PC names in a text file and I am trying to determine which users are logged on those PC's.

I would like to have a vbscript which will read the text file and return the logon name.

Any help appreciated

Kachbo

 

[markdmac]

Ask and yee shall receive.

'==========================================================================
'
' NAME: WhoIsLoggedInThere.vbs
'
' AUTHOR: Mark D. MacLachlan , The Spider's Parlor
' URL: [URL unfurl="true"]http://www.thespidersparlor.com[/URL]
' DATE  : 3/29/2005
'
' COMMENT: Prompts for a PC name and returns currently logged in user
'
'==========================================================================

strComputer = InputBox("Computer to Query for Logged In User","Search where?")

On Error Resume Next

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48)
For Each objItem in colItems
    Wscript.Echo "UserName: " & objItem.UserName & " is logged in at computer " & strComputer
Next

For the code to make this script run against multiple machines please refer to my FAQ faq329-4871.

I hope you find this post helpful.

Regards,

Mark

 

[kachbo1]

Hi MArk,

First of all thanks for the script, however it doesn't seem to work. I have all the workstation names listed in the wslist.txt file. It does not seem to return anything back.

Please help.

Kachbo.


On Error Resume Next

'open the file system object
Set oFSO = CreateObject("Scripting.FileSystemObject")
set WSHShell = wscript.createObject("wscript.shell")
'open the data file
Set oTextStream = oFSO.OpenTextFile("wslist.txt")
'make an array from the data file
RemotePC = Split(oTextStream.ReadAll, vbNewLine)
'close the data file
oTextStream.Close
For Each strComputer In RemotePC

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = 'Notepad.exe'")
For Each objProcess in colProcessList
objProcess.Terminate()
Next

Next

 

[mrmovie]

the code you have posted terminates 'notepad' threads on the target machines.........i dont think that is your intention??? good job is wasnt something like winword.exe

 

[markdmac]

I think you misunderstood the purpose of my referring you to the FAQ. It was to demo how to modify the above script.

Anyway here is what you want.

On Error Resume Next

'open the file system object
Set oFSO = CreateObject("Scripting.FileSystemObject")
set WSHShell = wscript.createObject("wscript.shell")
'open the data file
Set oTextStream = oFSO.OpenTextFile("wslist.txt")
'make an array from the data file
RemotePC = Split(oTextStream.ReadAll, vbNewLine)
'close the data file
oTextStream.Close
For Each strComputer In RemotePC
	Set objWMIService = GetObject("winmgmts:" _
	Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
	Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48)
	For Each objItem in colItems
	    Report = Report &  "UserName: " & objItem.UserName & " is logged in at computer " & strComputer & vbCrLf
	Next
Next

Set ts = oFSO.CreateTextFile ("logreport.txt", ForWriting)
ts.write report

I hope you find this post helpful.

Regards,

Mark

 

[TheLad]

Another top script, have a star!

-----------------------------------------------------
"It's true, its damn true!"
-----------------------------------------------------

 

[markdmac]

Don't think I should have to say this but I will anyway. In order for the script to work you need to be running it with an ID that has Admin rights on the target machines.

I hope you find this post helpful.

Regards,

Mark

 

[JGillespie]

Just adding a thought here. we do something similar, however we query our domain controllers for active sessions to determine who is logged on where as it is much faster than WMI calls to a list of computers (especially if those computers happened to be turned off!)

Jamie

Jamie Gillespie
j-gillespie@s-cheshire.ac.uk

 

[markdmac]

I think querying the DC is a great idea, you will however need to query EVERY DC in order to ensure you get a complete list since the sessions will be logged by whichever DC authenticates the user.

I think that this also has one draw back in that it may not help to identify where a user is getting locked out from. If a user session gets disconnected but the user remains logged onto the local PC with an old password, I don't believe their will be a user session to report.

Guess it all depends on what you want to use the data for.

I hope you find this post helpful.

Regards,

Mark