Track logged user activity history of windows

(imported topic written by Niraj Kumar Mishra)

Hi All,

I am trying to extract the activity histories of all logged on users on the machines. I am trying below relevance using Local Client Evaluator.

Q:activity histories of logged on user

E: The operator “string” is not defined.

when I use the below relevance

Q:exists activity histories of logged on user

A: False

T: 0.034 ms

BES Client UI is enabled on the machine and I did some changes on the machine.

Could you please guide me that how I can get the activity history of logged on user on the machine for windows ?

Thanks

Niraj

(imported comment written by Tim.Rice)

IEM is not really intended to do what you are attempting.

The Fixlet Debugger (QnA) allows you to explore the available objects you can inspect. Try typing the following …

Q: properties

then to limit the list of properties you can use something like …

Q: properties whose (it as lowercase contains “computer”)

IEM doesn’t attempt to “monitor” user activities like you seem to be asking about. It can be used to look for specific conditions, and configured to take specific actions when the conditions are found. For example, if a user changes a setting you don’t want changed, you can detect the setting with the “wrong” value and reset it.

(imported comment written by Niraj Kumar Mishra)

Hi Tim,

First of all, I am very thankful to you for your kind help in this regards.But I went through below link and it states.

https://support.bigfix.com/inspectors/User%20Objects_Any.html#activity%20history

The Inspectors keep track of the activity of a single logged-on user. You may iterate over all logged-on users and get the history for each user separately. User information is purged at log off and power off/client off, even if the user immediately logs back in. These Inspectors retrieve information within a tracking window (defaulting to 14 days) or, if the window is still open, the start of that window. Information is in the form of a list of (interval, state) tuples. The first element of the list is the current state of the system. The event lists are fetched from the client each time ‘activity history’ is referenced, so you should avoid referencing these Inspectors more than once in a relevance statement. Note: Activity tracking only works while the Client UI is running. These Inspectors only work with Windows 2000 or better.

Creation Methods

Declaration

Description

activity history of

Returns the activity history of the specified logged-on user. This.

(imported comment written by Tim.Rice)

My apologies. I’ve never tried to use that inspector. I’ll test it in the office and get back to you.


I tried to look into the Activity History object, but there just doesn’t seem to be much detail available. I get the same error you do about the “String” operator not being defined. Interestingly, if I try the following …

Q: Number of activity histories of current user

A: 0

Maybe it’s not IEM that’s not reporting anything, maybe it’s Windows that’s not performing the tracking. I’m running Windows 8.1 in a Domain environment, and I have no idea what you are expecting to receive from the Activity History object.

This is starting to sound like a question for “the Developers” to Answer, and might require a PMR be submitted to get an answer.

I tend to see IEM as less of a “monitor and report” tool and more of a real-time “find it and fix it tool”.

(imported comment written by Niraj Kumar Mishra)

Hi Tim,

Thanks for the update. As per my understanding, activity history mean… what ever user do some changes/modification/ on the machine in the period of login till logoff.

Thanks

Niraj