My Windows XP work computer is setup to allow multiple users to login and use the computer at the same time. Because the workers remote access I would like to be able to tell when access is taking place and the programs being used. I guess I'm looking for a logfile.
Much appreciate any advice.
Pat
You could create a GPO with login/logout scripts to keep track of when users log on and log off. You could also use a Visual Basic script, or possibly even a few wmic commands in a batch file, to pull the same information from the Security event log, which IIRC gets events added to it when users log on and log off.
As for obtaining information on running programs, I've never done it myself but take a look at this TechNet article which explains how to list processes running under TS sessions, and at this other TechNet article describing how to list running sessions -- the latter looks like it should include usernames, which may save you the trouble of adding a GPO or writing code to digest the security log.
From the look of it, you might be able to just create a batch file containing
@echo off
date /t >> ts-log.txt
time /t >> ts-log.txt
query session >> ts-log.txt
query process * >> ts-log.txt
echo "" >> ts-log.txt
and create a scheduled task to run it every five or ten minutes, and have all you need -- though I'd recommend creating another task to rotate that logfile every day or so, and maybe keep only a week's worth or thereabout, because otherwise it's likely to end up eating a lot of space very fast.
Hope this helps!
