How to collect Windows events on login and logout

Question

0.00/5 (No votes)

See more:

Hi Seniors,

I have developed a program to collect system login and logout informations from Windows Event logs.

This program creates a text file on local & server machine.

It's working fine with my Windows system that has enough Admin rights.

But when i run my application on another Windows computer (exe - copied and pasted) it requires 'Administrator Password'. then it's working fine.

The problem is, we have nearly 100 machines in a Domain and we need to collect Logs from the same for 200 users working on 100 machines.

Thanks,
Rajan.

Posted 13-Aug-14 3:22am

NPSSR

Updated 13-Aug-14 3:45am

Kim Togo

v3

Add a Solution

Comments

Maciej Los 13-Aug-14 9:26am

Yes, you do.

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Pheonyx · Answer 1 · 2014-08-13T03:27:00

If this is a genuine program, I would suggest looking at a windows service program. This can then be set to run with sufficient privileges to access the event log and do what you need to do.

Then you just need a method of deployment, so companies use Group Policy managed deployment to deploy software, or you need to go around each machine, login as an administrator and install the service.

An alternative to the service approach is to create a Scheduled task that runs as an administrator on each machine, again I believe (although I'm not certain) this is something that can be deployed by scripting/Group Policy. The scheduled task then just runs your program at the required frequency.

Kim Togo · Answer 2 · 2014-08-13T03:30:00

Solution 2

In Windows, there is a feature called UAC (User Access Control), what will prompt the user if the program is accessing informations that need higher rights than standard user.

If the program is running as a part of Group Policy Login script in Windows, it will have Local Administrator rights and will be able to get informations that need higher rights, then a standard user.

Posted 13-Aug-14 3:30am

Kim Togo

Comments

NPSSR 14-Aug-14 4:23am

Is this task can be done using "Microsoft.Win32.SystemEvents" is the best alternative way? Or any disadvantages with this.? Please advise.!

Kim Togo 14-Aug-14 4:35am

Hi.
Microsoft.Win32.SystemEvents will not work, SystemEvents event like SessionSwitch is only for current logged in user.
And the current user has no admin rights.

Alternative method is to use Windows Task Scheduler, if it is Windows 7 or Windows 8. Task can run when any user logged on and you can define what security rights that Task runs under.