Script for monitoring the user Access report(logon/logoff/logonfailure)

Download JSON Download Python

Ratings

(0)

Release Time

06/05/2017

Downloads

1565 times

Update Time

11/20/2024

Views

1982 times

Share-it:

Tags

User accounts Script monitroing accounts actions UAC logon logoff failure

Description
Screen Shots

Please refer the below Script monitor, To Monitor Users Access Report(It will implement a report of all accesses (Logon, Logoff, Failed Logon) in Windows. For example, If the user login it will display "LOGON ATTEMPT WAS MADE IN YOUR SYSTEM ", if it log off then it will display "LOGOFF ATTEMPT WAS MADE IN YOUR SYSTEM", and also it will show whenever the user fails to login it will display "UNABLE TO LOGON\A LOGON FAILURE WAS MADE IN YOUR SYSTEM". If any of these conditions doesn't meet then it will display "No Logon, Logoff and Logon Failure has happened in your system".

Please refer the wiki guide for how to use the custom monitoring scripts:

https://forum.mspconsortium.com/forum/products/other-comodo-products/comodo-device-management/wiki-faq-how-to/11486-how-to-use-custom-script-procedure-monitoring

Tested OS: This script has tested on Windows(7), Windows(8,8.1), Windows(10) Machines

Procedure's Instructions

# The script is a template to check UAC status on device.
import os
import sys
import _winreg

def alert(arg):
    sys.stderr.write("%d%d%d" % (arg, arg, arg))

# Please use "alert(1)" to turn on the monitor(trigger an alert)
# Please use "alert(0)" to turn off the monitor(disable an alert)
# Please do not change above block and write your script below
def admin_accesses():
    import os
    import re
    import getpass
    import socket
    print "USER NAME: "+getpass.getuser()
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    s.connect(("8.8.8.8", 80))
    print "IP-ADDRESS : "+(s.getsockname()[0])
    from time import gmtime, strftime
    time=strftime("%Y-%m-%d %H:%M:%S", gmtime())
    #logon attempt
    event_logs1=os.popen('wevtutil qe Security /f:text /c:5000 /rd:True').read()
    reg_log=re.findall('Event\sID:\s[0-9]{4}',event_logs1)
    get_reg1=0
    for id in reg_log:
        if id=='Event ID: 528':
            get_reg1=get_reg1+1
        elif id=='Event ID: 4624':
            get_reg1=get_reg1+1
        elif id=='Event ID: 4672':
            get_reg1=get_reg1+1

#LOGOFF
    event_logs2=os.popen('wevtutil qe Security /f:text /c:5000 /rd:True').read()
    reg_log=re.findall('Event\sID:\s[0-9]{4}',event_logs2)
    get_reg2=0
    for id in reg_log:
        if id=='Event ID: 538':
            get_reg2=get_reg2+1
        elif id=='Event ID: 4634':
            get_reg2=get_reg2+1
        elif id=='Event ID: 4647':
            get_reg2=get_reg2+1

#logon failure atttempt
    event_logs3=os.popen('wevtutil qe Security /f:text /c:5000 /rd:True').read()
    reg_log=re.findall('Event\sID:\s[0-9]{4}',event_logs3)
    get_reg3=0
    for id in reg_log:
        if id=='Event ID: 537':
            get_reg3=get_reg3+1
        elif id=='Event ID: 4625':
            get_reg3=get_reg3+1

if get_reg1 > 0:
        alert(1)
        print '\nA LOGON ATTEMPT WAS MADE IN YOUR SYSTEM'
    elif get_reg2 > 0:
        alert(1)
        print '\nA LOGOFF ATTEMPT WAS MADE IN YOUR SYSTEM'
    elif get_reg3 > 0:
        alert(1)
        print'\nUNABLE TO LOGON\A LOGON FAILURE WAS MADE IN YOUR SYSTEM'
    else:
        alert(0)
        print '\nNo Logon, Logoff and Logon Failure was happened'
admin_accesses()

Comments

No Comments.

Script for monitoring the user Access report(logon/logoff/logonfailure)

Comments

Leave a Comment