Triggering an action on Login event

1

Hello Everyone,

I am trying to deploy an action that can trigger on Login event in windows machines. Is is feasible in Bigfix. We are on version 11.0.3.

2

You got the event log inspector - https://developer.bigfix.com/relevance/reference/event-log.html

What is your specific criteria for applying the action?

3

Thank you Orbiton. I want to trigger my action when user login the machine. Action should wait until it gets next login event on machine.

4

I’d be interested to better understand the use case here if you’re able to share more details.

That said, there is a deployment option to constrain actions to execute when users are present. See the following for reference:

5

@mishravk23, have you tried something like adding ‘exists current user’ to the relevance of your job? If you make a policy action targeting a group of machines, then when someone logs on, the machine would become relevant and run.

6

Hi Orbiton,
I want that action will execute at the login time, actually we are migrating VPN in our environment at it is disrupting few apps for few mins. So to avoid the impact on users we want to schedule it to trigger on next login as we are expecting that if it will execute at during login then it will not impact any critical process that user is doing during the working hours.

7

Hi, In that case it will execute if user is presently working on the machine. we want to avoid that we want do it like startup script.

8

@mishravk23 please check to following:

You’re looking to identify user login events in the Windows Event Viewer, covering both local and Remote Desktop Protocol (RDP) logins. Here’s how you can achieve this, along with the relevant event IDs and filtering techniques:
Key Event IDs:

  • 4624 (An account was successfully logged on): This is the primary event ID you’ll be working with. It captures both local and remote logins.
  • 4634 (An account was logged off): This event ID indicates logoff events, which can be useful for tracking session durations.
    Filtering for Local and RDP Logins:
    To distinguish between local and RDP logins, you’ll need to examine the “Logon Type” field within the 4624 event details.
  • Local Logins:
    • Logon Type: 2 (Interactive)
  • RDP Logins:
    • Logon Type: 10 (RemoteInteractive)
      Steps to Filter in Event Viewer:
  • Open Event Viewer:
    • Press Windows key + R, type eventvwr.msc, and press Enter.
  • Navigate to Windows Logs > Security:
    • In the left pane, expand “Windows Logs” and select “Security.”
  • Filter Current Log:
    • In the right pane, click “Filter Current Log…”
  • Enter Event ID:
    • In the “Event IDs” field, enter 4624.
  • Filter by Logon Type (Optional):
    • To further refine the results, switch to the “XML” tab.
    • Here you can input XML queries.
    • Local Logins XML Query:
      • *[System[EventID=4624] and EventData[Data[@Name=‘LogonType’]=‘2’]]
    • RDP Logins XML Query:
      • *[System[EventID=4624] and EventData[Data[@Name=‘LogonType’]=‘10’]]
    • Paste the appropiate query into the XML filter field.
  • Click OK:
    • The Event Viewer will now display only the events that match your filter criteria.
  • Examine Event Details:
    • Double-click an event to view its details.
    • Pay close attention to the “Account Name,” “Logon Type,” “Logon ID,” and “Source Network Address” (for RDP logins).
      Important Notes:
  • Security Auditing: Ensure that security auditing is enabled for logon events. If not, the events won’t be logged. You can configure this in the Local Security Policy (secpol.msc).

Can you please make sure that those events are being written on the event viewer?

2 Likes
9

If you’re going to depend on user interaction, why not send it with a "user confirmation’ interaction in the Action Settings?

Otherwise, I’d recommend dropping a script into one of the startup areas in Windows - the Run key of the registry, the Start Menu\Programs\Startup folder,.the Task Scheduler, or the Active setup registry keys.