Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am concerned that one of our servers is being abused for a few various reasons.

Is there a tool that can send an email when ever a user logons onto the server?

I would like to get an email with as much info as possible sent to me in the background.

Thanks

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I use a logon script for this in a GPO at domain root level. A simplified version might look something like:

Set ADSysInfo = CreateObject ("ADSystemInfo")
Set currComp = GetObject ("LDAP://" & ADSysInfo.ComputerName)
Set CurrUser = GetObject ("LDAP://" & ADSysInfo.UserName)

if CurrComp.operatingSystem = "Windows 2000 Server" or _
   CurrComp.operatingSystem = "Windows Server 2003" then
       ' send email via whatever SMTP server/etc you have in place
       ' this will be different depending on the server so i can't give code
       ' CurrUser.sAMAccountName - user account name
       ' CurrComp.cn - name of server being logged on to
endif

You'll need to dig out ways of sending email via script on TechNet for the missing part of it

share|improve this answer
    
+1 that's solid as well –  Malnizzle Feb 23 '10 at 16:26
    
Thanks Mh. Will this work for local accounts as well or only domain accounts on the AD? I need to get alerts for both. –  SetiSeeker Feb 23 '10 at 16:38
    
Only domain accounts if it's in a GPO. The LDAP:// stuff would also need to be changed to the correct namespace for local accounts, you wouldn't use ADSystemInfo, and your SMTP permissions would need to allow a local account to access it. Besides which, if someone has "abuse the server" local access, they can already bypass a local logon script anyway. –  Darth Satan Feb 23 '10 at 17:00

If Server 2008, create a sch task and define a trigger with "on an event". You'll most likely want to use 528 as your event, then you action would be "send an email". You'll need a SMTP server.

http://technet.microsoft.com/en-us/library/cc787567(WS.10).aspx for event IDs.

share|improve this answer
    
Thanks for the help, my problem is this is windows 2003 server. –  SetiSeeker Feb 23 '10 at 16:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.