Fixlet to tracks all logged on users

Customizations
1

Hi all,
The Customer asks me to create a fixlet that tracks all users who connect to a limited number of servers.
I created a fixlet, of which I attach the bes file, which has as its relevance the presence of a logged in user:

(if(name of operating system as lowercase starts with “win”) then exists logged on users else true)

and which, in action, creates a file (with the name of the logged in user).
I created this fixlet as a policy and must be reapplied every time it is relevant, but it only runs with the first user logon and no longer with subsequent ones.
Can someone help me?
TraceLogUser.bes (4.3 KB)

Thank you
Giorgio

2

Are you looking for local logged on users or do you want to include those that log in RDP as well?

3

Hi Dean,
All, also those that log in RDP.

4

Is this not something better accomplished via auditing?

5

The Customer tells me no because it only concerns a subset of servers and users so it would be more complex to implement the solution via GPO.
The thing I don’t understand in my fixlet is why it isn’t executed at every user logon since it is set to behave in this way anyway. I would like to understand where the limit is.

6

The Fixlet would have to evaluate Non-Relevant and then Relevant again to reapply. If there is only a short time between user logins,.that may not be enough time for the Fixlet to re-evaluate.

You may need to change the behavior to “Reapply while relevant”, or use a setting to store.the last username and have the relevance toggle when the stored username differs from the current one.

7

Thanks Jason,
You are a genius :mage:. I’ll do some tests now and then I’ll update you.