2

I am concerned that one of our servers is being abused for a few various reasons.

Is there a tool that can send an email when ever a user logons onto the server?

I would like to get an email with as much info as possible sent to me in the background.

Thanks

Improve this question

2 Answers 2

Reset to default
2

I use a logon script for this in a GPO at domain root level. A simplified version might look something like:

Set ADSysInfo = CreateObject ("ADSystemInfo")
Set currComp = GetObject ("LDAP://" & ADSysInfo.ComputerName)
Set CurrUser = GetObject ("LDAP://" & ADSysInfo.UserName)

if CurrComp.operatingSystem = "Windows 2000 Server" or _
   CurrComp.operatingSystem = "Windows Server 2003" then
       ' send email via whatever SMTP server/etc you have in place
       ' this will be different depending on the server so i can't give code
       ' CurrUser.sAMAccountName - user account name
       ' CurrComp.cn - name of server being logged on to
endif

You'll need to dig out ways of sending email via script on TechNet for the missing part of it

Improve this answer
3
  • +1 that's solid as well
    – Malnizzle
    Feb 23, 2010 at 16:26
  • Thanks Mh. Will this work for local accounts as well or only domain accounts on the AD? I need to get alerts for both.
    – SetiSeeker
    Feb 23, 2010 at 16:38
  • Only domain accounts if it's in a GPO. The LDAP:// stuff would also need to be changed to the correct namespace for local accounts, you wouldn't use ADSystemInfo, and your SMTP permissions would need to allow a local account to access it. Besides which, if someone has "abuse the server" local access, they can already bypass a local logon script anyway.
    – Maximus Minimus
    Feb 23, 2010 at 17:00
2

If Server 2008, create a sch task and define a trigger with "on an event". You'll most likely want to use 528 as your event, then you action would be "send an email". You'll need a SMTP server.

http://technet.microsoft.com/en-us/library/cc787567(WS.10).aspx for event IDs.

Improve this answer
1
  • Thanks for the help, my problem is this is windows 2003 server.
    – SetiSeeker
    Feb 23, 2010 at 16:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .