Is there a way to monitor screensaver usage?

[Dave]

Situation: Our systems are configured to run a screensaver (locked with
user/pass required) after 10 minutes of non-activity.

Goal: I would like to monitor how long the screensaver actually runs on
that system.

Example: Say a user logs in at 8:00am, uses the system actively for 30
minutes, and then leaves to do something else. They don't return to
the system until the next day.

Required solution: I would like to calculate the amount of time that
screensaver actually ran, preferably logged to track usage over a given
time frame. In the example given, it would indicate that the
screensaver ran from 8:30am on July 19th till 8:00am on July 20th, for
a total of 23 hours, 30 minutes.

Now, I understand that we can force the screensaver to log the person
out, but that still doesn't show me how long the machine was being
actively used. One possible solution would be to use the Event Viewer.
However I know of no way to monitor the usage of a given application
via this program.

I'm open to suggestions, and thank you in advance.

Dave

 

[Steven L Umbach]

Well it could be done if you enable auditing of process tracking in the
Local Security Policy of the computer. However that will track ALL processes
that are run but the info you need should be there. You then could try using
something like the free Event Comb from Microsoft to search for the text
string of the process you want to track or try a third party program such as
SELM [free to try] to see if it is worth the money to help generate reports,
etc. You will also need to increase the size of the security log
substantially if you enable auditing of process tracking. Below is an
example of that would be recorded in the security log.

Steve

http://www.gfi.com/lanselm/ --- SELM

Event Type: Success Audit
Event Source: Security
Event Category: Detailed Tracking
Event ID: 592
Date: 7/20/2006
Time: 12:20:20 PM
User: STEVE-XP\Steve
Computer: STEVE-XP
Description:
A new process has been created:
New Process ID: 2772
Image File Name: D:\WINDOWS\system32\logon.scr
Creator Process ID: 2304
User Name: Steve
Domain: STEVE-XP
Logon ID: (0x0,0xD91A)


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Success Audit
Event Source: Security
Event Category: Detailed Tracking
Event ID: 593
Date: 7/20/2006
Time: 12:20:26 PM
User: STEVE-XP\Steve
Computer: STEVE-XP
Description:
A process has exited:
Process ID: 3384
Image File Name: D:\WINDOWS\system32\logon.scr
User Name: Steve
Domain: STEVE-XP
Logon ID: (0x0,0xD91A)


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[Dave]

Steven,

Thank you for the suggestion. I liked the idea of doing it thru Event
Viewer, but stumbled across something that will work (for my purposes)
even better. Over on SysInternals website there is a utility called
'PSList'. It allows you to query the processes (even specific
proceses) of your own system, as well as systems across the AD network,
via the RPC service. Thus I can monitor, from my own location, the
screensaver activity of the system(s) that I want to watch.

As a result, I have created a batch file that does montior a select
number of systems for the screensaver process. It queries the remote
system every 10 minutes (that granularity works well for my purposes),
and I log the events here. It makes auditing remote systems (of which
we have a bunch) considerably easier.

Thanks for the reply again. Some of your terminology allowed me to
refine my own searches better, thus leading me to resolving my problem.

Dave

Well it could be done if you enable auditing of process tracking in the
Local Security Policy of the computer. However that will track ALL processes
that are run but the info you need should be there. You then could try using
something like the free Event Comb from Microsoft to search for the text
string of the process you want to track or try a third party program such as
SELM [free to try] to see if it is worth the money to help generate reports,
etc. You will also need to increase the size of the security log
substantially if you enable auditing of process tracking. Below is an
example of that would be recorded in the security log.

Steve

<snip>