Page 1 of 2 12>
Topic Options
#120753 - 2004-06-07 09:21 PM I feel unclean now.... for i am "bigbrother" :(
Bryce Offline
KiX Supporter
*****

Registered: 2000-02-29
Posts: 3167
Loc: Houston TX
I had a question/request come my way to day....

"i need a way to log user activity.... can we do that?"

this was the end result... needs the autoitx.dll

Code:

break on

$logfile = readprofilestring(@scriptdir+"\config.ini","Usage","Logfile")
$ = open(1,$logfile,5)

$autoit = CreateObject("AutoItX.Control")
if @error
shell '%comspec% /c regsvr32 "@scriptdir\AutoItX.dll" -s'
$autoit = CreateObject("AutoItX.Control")
if @error
beep beep beep
Quit
endif
endif

while not @error
$currentwindow = $autoit.WinGetActiveTitle
if $currentwindow <> $lastWindow
$lastwindow = $currentwindow
$ = writeline(1,@userid + " " + @date + " " + @time+" "+$currentWindow+@crlf)
endif
sleep (1)
loop


Top
#120754 - 2004-06-07 09:33 PM Re: I feel unclean now.... for i am "bigbrother" :(
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
not sure what's point in that.
keeping ie open all the time is not bad.
nor it's the dictionary that's used on it.

but the addresses visited or files opened are lot more suitable for spying.
done that for while mainly for my own delight of banning spyware&virus sites.

but pretty much same way can be big-brother code done.
this is easier and simpler though than mine, but mine has a GUI
_________________________
!

download KiXnet

Top
#120755 - 2004-06-08 04:41 AM Re: I feel unclean now.... for i am "bigbrother" :(
Sealeopard Offline
KiX Master
*****

Registered: 2001-04-25
Posts: 11165
Loc: Boston, MA, USA
How about enabling extensive auditing in the user's eventlogs?
_________________________
There are two types of vessels, submarines and targets.

Top
#120756 - 2004-06-08 09:26 AM Re: I feel unclean now.... for i am "bigbrother" :(
Jochen Administrator Offline
KiX Supporter
*****

Registered: 2000-03-17
Posts: 6380
Loc: Stuttgart, Germany
is this even ... legal ?
_________________________



Top
#120757 - 2004-06-08 10:18 AM Re: I feel unclean now.... for i am "bigbrother" :(
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Depends on what Country and or what State and when/if/how you have notified the potential user of such monitoring.

I know where I work it is illegal to monitor at that level without a Court Order.

Top
#120758 - 2004-06-08 11:32 AM Re: I feel unclean now.... for i am "bigbrother" :(
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
ja, but do you need to let the users know?
and then there comes privacy and company policy, you can't tell if you are observing someone, even though it's illegal.
_________________________
!

download KiXnet

Top
#120759 - 2004-06-08 04:11 PM Re: I feel unclean now.... for i am "bigbrother" :(
Night Hawk Offline
Fresh Scripter

Registered: 2002-10-09
Posts: 33
Loc: NC, USA
How do you run this on the subject i have had the same requests at times.:(
Top
#120760 - 2004-06-08 04:13 PM Re: I feel unclean now.... for i am "bigbrother" :(
Radimus Moderator Offline
Moderator
*****

Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
use iexpress.exe from IEAK to make an exe of it

then make an entry in the HKLM\...\RUN key for it
_________________________
How to ask questions the smart way <-----------> Before you ask

Top
#120761 - 2004-06-08 04:27 PM Re: I feel unclean now.... for i am "bigbrother" :(
Night Hawk Offline
Fresh Scripter

Registered: 2002-10-09
Posts: 33
Loc: NC, USA
i take it that the config.ini is created and added to the exe along with the dll then deployed to the machine in question
Top
#120762 - 2004-06-08 04:55 PM Re: I feel unclean now.... for i am "bigbrother" :(
Bryce Offline
KiX Supporter
*****

Registered: 2000-02-29
Posts: 3167
Loc: Houston TX
Here in the US "wiretap" laws very from state to state... For example Here in Texas, it is legal to record a telephone conversation as long as 1 of the parties involved know that they are being recorded.

There have been leagal cases fought and won in other states that require all parties to be informed that they are being recorded, when some type of recording software was used against them.

as for config.ini.... just set $logfile to equal a full path to the name of the file you want to dump to.


Code:

$logfile = @scriptdir+"\dump.txt"



a sample output....
blindsay 2004/06/08 09:41:57 C:\Documents and Settings\blindsay.FLAGSHIPCO\Desktop\Usage
blindsay 2004/06/08 09:42:02 KiXtart.org - official site: Reply to (Re: I feel unclean now.... for i am "bigbrother" ) - Microsoft Internet Explorer
blindsay 2004/06/08 09:42:05 http://www.kixtart.org/ubbthreads/newreply.php?Cat=&Board=UBB2&Number=119664&page=0&view=collap - Microsoft Internet Explorer
blindsay 2004/06/08 09:42:06 KiXtart.org - official site: Reply to (Re: I feel unclean now.... for i am "bigbrother" ) - Microsoft Internet Explorer
blindsay 2004/06/08 09:42:10 KiXtart.org - official site: Viewing list of forums - Microsoft Internet Explorer
blindsay 2004/06/08 09:42:12 KiXtart.org - official site: Viewing forum: starters - Microsoft Internet Explorer
blindsay 2004/06/08 09:42:20 KiXtart.org - official site: INSTR not working on the @ symbol - Microsoft Internet Explorer
blindsay 2004/06/08 09:42:28 KiXtart.org - official site: Viewing forum: starters - Microsoft Internet Explorer
blindsay 2004/06/08 09:42:31 KiXtart.org - official site: Kixtarter - KiXtart Script Editor - Microsoft Internet Explorer
blindsay 2004/06/08 09:42:37 KiXtart.org - official site: Viewing forum: starters - Microsoft Internet Explorer
blindsay 2004/06/08 09:42:41 KiXtart.org - official site: Add computer to a group - Microsoft Internet Explorer
blindsay 2004/06/08 09:42:57 KiXtart.org - official site: Viewing forum: starters - Microsoft Internet Explorer
blindsay 2004/06/08 09:42:58 KiXtart.org - official site: Viewing list of forums - Microsoft Internet Explorer
blindsay 2004/06/08 09:43:01 KiXtart.org - official site: Viewing forum: scripts - Microsoft Internet Explorer
blindsay 2004/06/08 09:43:06 KiXtart.org - official site: I feel unclean now.... for i am "bigbrother" - Microsoft Internet Explorer
blindsay 2004/06/08 09:43:10 Windows Task Manager
blindsay 2004/06/08 09:43:11 Task Manager Warning


Hmmm seems i need to do something about memory usage if left running to long...


Edited by Bryce (2004-06-08 04:58 PM)

Top
#120763 - 2004-06-08 05:04 PM Re: I feel unclean now.... for i am "bigbrother" :(
Richard H. Administrator Offline
Administrator
*****

Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
Increase the polling interval - 1 second is a bit of overkill.

Trash and recreate the autoit objects each cycle - maybe it has a memory leak.

Rather than Open()/Write use RedirectOutput() and open/close it on each cycle - the file will be up-to-date and there will be less memory overhead.

Top
#120764 - 2004-06-09 05:16 PM Re: I feel unclean now.... for i am "bigbrother" :(
Radimus Moderator Offline
Moderator
*****

Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
Code:
 

$ltext= "WARNING! By accessing this system you are consenting to system monitoring" +@crlf+
"and agreeing to follow the Agency's policies regarding acceptable use," +@crlf+
"protection of information resources, and confidential health care information." +@crlf+
"Improper or illegal use of this computer may subject you to an investigation" +@crlf+
"and could result in either disciplinary action in accordance with the Agency's" +@crlf+
"standards, or possible civil or criminal penalties." +@crlf
$=WriteValue("$HKLMSMWNTCV\Winlogon","LegalNoticeCaption","Unauthorized Use Prohibited",REG_SZ)
$=WriteValue("$HKLMSMWNTCV\Winlogon","LegalNoticeText",$ltext,REG_SZ)




1 sec might be a bit much... but I could see 3-5 sec.

you might get away with cleaning resources by making it run a new copy of itself and then terminating every hour or whatever... depends on what the nature of the mem leak is:

if $hour<>$lasthour
run "cmd /c kix32 bigbrother.kix"
quit
endif
_________________________
How to ask questions the smart way <-----------> Before you ask

Top
#120765 - 2004-06-09 05:51 PM Re: I feel unclean now.... for i am "bigbrother" :(
Bryce Offline
KiX Supporter
*****

Registered: 2000-02-29
Posts: 3167
Loc: Houston TX

I started it up and ran it all day yesterday... no memory leak. I think it was something else that was chewing up all of my memory. When you only got 256m... you run out quick. I got tired of running out, so i stole.. err, acquired a 2nd 256m stick from a dead computer

Bryce

Top
#120766 - 2004-06-09 08:35 PM Re: I feel unclean now.... for i am "bigbrother" :(
ShaneEP Moderator Offline
MM club member
*****

Registered: 2002-11-29
Posts: 2127
Loc: Tulsa, OK
Wow...that a pretty nice simple, yet scary, little script ya got there. Anyone know of a good place to find the privacy laws for particular states?
Top
#120767 - 2004-06-09 10:06 PM Re: I feel unclean now.... for i am "bigbrother" :(
Radimus Moderator Offline
Moderator
*****

Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
I don't even think privacy laws are an issue here.

you have a logon notice that states these computers are for official business only, and may be monitored without notice

AND

have a notice/document/sgreement passed around to collect signatures.

computer privacy in the workplace is non-existant... look how long emails have to be saved. MS tried to scoot out from that requirement and got blasted by the courts.
_________________________
How to ask questions the smart way <-----------> Before you ask

Top
#120768 - 2004-06-09 10:25 PM Re: I feel unclean now.... for i am "bigbrother" :(
ShaneEP Moderator Offline
MM club member
*****

Registered: 2002-11-29
Posts: 2127
Loc: Tulsa, OK
Yea but I was thinking something along the lines if we wanted to collect this kind of info without the user knowing it. Wouldnt want to do anything illegal however. Then again...I wouldnt think something like logging a list of window titles would be invasion of privacy in the first place. It isnt like its reading the emails or recording phone calls.
Top
#120769 - 2004-06-09 11:18 PM Re: I feel unclean now.... for i am "bigbrother" :(
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Well in California (The SUE ME STATE). There are many laws with regards to when/why/how data is collected.

Of course it also depends on who your lawyer is too (ask OJ)

But the fact of having a banner that the user did not have to agree to (user can only click OK, you did not give option of No or Cancel)

You must also now notify any user Public/Private if any unauthorized individual has or might have accessed personal information that might lead to identity theft or disclosed financial/medical or similar information.

Even items that may only be a misdemeanor locally can become a felony when the information is carried across state lines.

VERY GRAY area to play with here if you don't have a legitimate reason, seeing that often you as an Administrator can also be held liable and not just your Company.

Don't think any of us are lawyers here, but speaking for myself I'll just steer clear of this type of activity unless our own legal department makes and authorizes the request.



Top
#120770 - 2004-06-10 04:29 AM Re: I feel unclean now.... for i am "bigbrother" :(
Sealeopard Offline
KiX Master
*****

Registered: 2001-04-25
Posts: 11165
Loc: Boston, MA, USA
I have to agree with NTDOC on this. Make sure the monitoring is legally tight and you cannot be held responsibly personally.
_________________________
There are two types of vessels, submarines and targets.

Top
#120771 - 2004-06-15 02:51 PM Re: I feel unclean now.... for i am "bigbrother" :(
scott_s Offline
Fresh Scripter

Registered: 2004-06-15
Posts: 15
If the company wants to monitor their users it should be ok. Since the company owns the computers and all the data on the copmuters.
Top
#120772 - 2004-06-15 03:19 PM Re: I feel unclean now.... for i am "bigbrother" :(
Richard H. Administrator Offline
Administrator
*****

Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
Quote:

If the company wants to monitor their users it should be ok. Since the company owns the computers and all the data on the copmuters.




You are joking!

I wish the various privacy acts around the world could be summarised in such simple language.

In order to protect right to privacy there are many local restrictions on what you can and cannot monitor - applicable to law enforcement, corporate bodies and private individuals in different guises.

Unfortunately they have been mostly implemented too quickly by people who don't understand:
a) The problem they are trying to fix.
b) The new problems that they have just created.

It leads to bizarre situations where we are responsible for ensuring compliance with one set of laws while being restricted from ensuring compliance by another set of laws.

Added into this confusion is the fact that the experts cannot provide clear guidelines because the lines of demarcation are so badly defined.

What this means is that the only way to be sure that you are not crossing the boundary is to wait until a disgruntled employee takes you to court. If you win then what you did was probably ok, if you lose then what you did was probably not.

Top
Page 1 of 2 12>


Moderator:  Glenn Barnas, NTDOC, Arend_, Jochen, Radimus, Allen, ShaneEP, Ruud van Velsen, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 1046 anonymous users online.
Newest Members
Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users

Generated in 0.075 seconds in which 0.026 seconds were spent on a total of 13 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org