{"id":37887,"date":"2019-10-31T22:20:23","date_gmt":"2019-10-31T19:20:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/windows-uznayom-kto-gde-zaloginen\/"},"modified":"2019-10-31T22:20:23","modified_gmt":"2019-10-31T19:20:23","slug":"windows-uznayom-kto-gde-zaloginen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/windows-uznayom-kto-gde-zaloginen","title":{"rendered":"Windows: zji\u0161t\u011bn\u00ed, kdo je kde p\u0159ihl\u00e1\u0161en","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Windows:<\/a><\/noindex>
\n \u2014 Omlouv\u00e1m se, nic mi nefunguje, pomozte mi!
\n \u2014 Nebojte se, hned to naprav\u00edme. Jak\u00e9 je jm\u00e9no po\u010d\u00edta\u010de\u2026
\n(klasika \u017e\u00e1nru z hovor\u016f na technickou podporu)<\/p>\n

Je dob\u0159e, pokud m\u00e1te n\u00e1stroj typu BgInfo nebo va\u0161i u\u017eivatel\u00e9 znaj\u00ed zkratku Windows+Pause\/Break a v\u011bd\u00ed, jak ji zm\u00e1\u010dknout. Dokonce se ob\u010das objev\u00ed vz\u00e1cn\u00e9 p\u0159\u00edpady, kte\u0159\u00ed si zapamatovali jm\u00e9no sv\u00e9ho stroje. Ale \u010dasto se b\u011bhem hovoru krom\u011b hlavn\u00edho probl\u00e9mu objev\u00ed i druh\u00fd: zjistit jm\u00e9no\/IP adresu po\u010d\u00edta\u010de. A ne\u017e se tento druh\u00fd probl\u00e9m vy\u0159e\u0161\u00ed, trv\u00e1 to \u010dasto mnohem d\u00e9le ne\u017e prvn\u00ed (a p\u0159itom sta\u010dilo jen zm\u011bnit pozad\u00ed nebo vr\u00e1tit ztracenou z\u00e1stupce :).
\nA p\u0159ece je mnohem p\u0159\u00edjemn\u011bj\u0161\u00ed sly\u0161et n\u011bco jako:
\n \u2014 Tatiano Sergejevno, ned\u011blejte si starosti, ji\u017e se p\u0159ipojuji\u2026<\/p>\n

<\/a><\/noindex>
\nA nen\u00ed k tomu pot\u0159eba tak moc.
\nSpecialistovi technick\u00e9 podpory sta\u010d\u00ed si zapamatovat jm\u00e9na stroj\u016f a v\u011bd\u011bt, kdo na \u010dem pracuje.
\nP\u0159ed popisem \u0159e\u0161en\u00ed, kter\u00e9 nyn\u00ed pou\u017e\u00edv\u00e1me, stru\u010dn\u011b proberu jin\u00e9 mo\u017enosti, abych je moc kritizoval a vysv\u011btlil svoj\u00ed volbu.<\/p>\n

    \n
  1. BgInfo<\/a><\/noindex>, Desktop Info<\/a><\/noindex> a podobn\u00e9. Pokud m\u00e1te hodn\u011b pen\u011bz, jsou k dost\u00e1n\u00ed i placen\u00e9 verze. Podstatou je, \u017ee na desktopu se zobrazuj\u00ed technick\u00e9 informace: jm\u00e9no stroje, IP adresa, p\u0159ihl\u00e1\u0161en\u00ed atd. V Desktop Info je dokonce mo\u017en\u00e9 vm\u011bstnat grafy v\u00fdkonu na polovinu obrazovky.
    \nNedostate\u010dn\u00e9 je, \u017ee pro stejn\u00e9 Bginfo, nap\u0159\u00edklad, u\u017eivatel mus\u00ed minimalizovat okna, aby vid\u011bl pot\u0159ebn\u00e1 data. Tak\u00e9 jsme s kolegy n\u011bkolikr\u00e1t pozorovali u BgInfo     charakteristick\u00e9 artefakty<\/a><\/noindex>, kdy\u017e se nov\u00fd text zobrazuje p\u0159es star\u00fd.
    \nN\u011bkte\u0159\u00ed u\u017eivatel\u00e9 obt\u011b\u017euje, \u017ee administr\u00e1to\u0159i kresl\u00ed hrozivou 192.168.0.123 na obli\u010deji nat\u00e1hnut\u00e9ho ko\u010di\u010d\u00edka na pracovn\u00edm stole, co\u017e kaz\u00ed estetiku pozad\u00ed, a samoz\u0159ejm\u011b to hrozn\u011b demotivuje a naprosto ni\u010d\u00ed pracovn\u00ed atmosf\u00e9ru.\n <\/li>\n
  2. Z\u00e1stupce typu \"Kdo jsem\" (nesna\u017ete se mu na konci p\u0159idat otazn\u00edk :). Klasick\u00fd z\u00e1stupce na plo\u0161e, za kter\u00fdm se skr\u00fdv\u00e1 \u010dist\u00fd nebo m\u00e9n\u011b upraven\u00fd skript, zobrazuj\u00edc\u00ed pot\u0159ebn\u00e9 informace v podob\u011b dialogov\u00e9ho okna. N\u011bkdy m\u00edsto z\u00e1stupce na plo\u0161e umis\u0165uj\u00ed p\u0159\u00edmo skript, co\u017e, IMHO, nen\u00ed zrovna dobr\u00fd styl.
    \nNev\u00fdhodou je, \u017ee pro spu\u0161t\u011bn\u00ed z\u00e1stupce, stejn\u011b jako v prvn\u00edm p\u0159\u00edpad\u011b, je nutn\u00e9 minimalizovat v\u0161echna otev\u0159en\u00e1 okna (nebereme v \u00favahu \u0161\u0165astlivce, kte\u0159\u00ed maj\u00ed na pracovn\u00ed stanici otev\u0159en\u00e9 jedin\u00e9 okno s soliterem). Mimochodem, v\u00ed va\u0161i u\u017eivatel\u00e9, kam mus\u00ed kliknout, aby minimalizovali v\u0161echna okna? Spr\u00e1vn\u011b, prstem do oka admina.\n <\/li>\n<\/ol>\n

    \nTak\u00e9 k\u00e1po nazna\u010duje, \u017ee oba v\u00fd\u0161e popsan\u00e9 zp\u016fsoby maj\u00ed spole\u010dnou nev\u00fdhodu v tom, \u017ee na z\u00edsk\u00e1n\u00ed informac\u00ed se pod\u00edl\u00ed u\u017eivatel, kter\u00fd m\u016f\u017ee b\u00fdt pomal\u00fd, hloup\u00fd a v\u016fbec lh\u00e1t.
    \nVarianta se zvy\u0161ov\u00e1n\u00edm po\u010d\u00edta\u010dov\u00e9 gramotnosti, kdy v\u0161ichni v\u011bd\u00ed, kde ve Windows zjistit jm\u00e9no sv\u00e9ho stroje, se nezab\u00fdv\u00e1m: jde o u\u0161lechtilou, ale velmi obt\u00ed\u017enou z\u00e1le\u017eitost. A pokud v spole\u010dnosti doch\u00e1z\u00ed k fluktuaci zam\u011bstnanc\u016f, pak \u00fapln\u011b marn\u00e1 v\u011bc. Co si pov\u00eddat, ve v\u011bt\u0161in\u011b p\u0159\u00edpad\u016f si ani nepamatuj\u00ed sv\u00e9 u\u017eivatelsk\u00e9 jm\u00e9no.<\/p>\n

    Vylil jsem du\u0161i, a nyn\u00ed k v\u011bci.
    \nJako z\u00e1klad byla vzata my\u0161lenka od \u010dlena komunity Habr.     mittel<\/a><\/noindex> z tohoto \u010dl\u00e1nku<\/a><\/noindex>.
    \nPodstata my\u0161lenky spo\u010d\u00edv\u00e1 v tom, \u017ee p\u0159i p\u0159ihl\u00e1\u0161en\u00ed u\u017eivatele do Windows p\u0159ihla\u0161ovac\u00ed skript zaznamen\u00e1v\u00e1 pot\u0159ebn\u00e9 informace (\u010das a jm\u00e9no stroje) do ur\u010dit\u00e9ho atributu u\u017eivatelsk\u00e9ho \u00fa\u010dtu. A p\u0159i odhl\u00e1\u0161en\u00ed ze syst\u00e9mu se spust\u00ed podobn\u00fd odhla\u0161ovac\u00ed skript.<\/p>\n

    Samotn\u00e1 my\u0161lenka se mi l\u00edbila, ale v realizaci m\u011b n\u011bkter\u00e9 v\u011bci nenadchly.<\/p>\n

      \n
    1. Skupinov\u00e1 politika, ve kter\u00e9 jsou definov\u00e1ny p\u0159ihla\u0161ovac\u00ed a odhla\u0161ovac\u00ed skripty pro u\u017eivatele, se aplikuje na celou dom\u00e9nu, proto skripty budou fungovat na jak\u00e9mkoli stroji, na kter\u00e9m se u\u017eivatel\u00e9 p\u0159ihla\u0161uj\u00ed. Pokud krom\u011b pracovn\u00edch stanic pou\u017e\u00edv\u00e1te termin\u00e1lov\u00e1 \u0159e\u0161en\u00ed (nap\u0159\u00edklad Microsoft RDS nebo produkty Citrix), tento p\u0159\u00edstup nebude pohodln\u00fd.\n <\/li>\n
    2. Data se zaznamen\u00e1vaj\u00ed do atributu Department u\u017eivatelsk\u00e9ho \u00fa\u010dtu, na kter\u00fd m\u00e1 b\u011b\u017en\u00fd u\u017eivatel p\u0159\u00edstup pouze pro \u010dten\u00ed. Krom\u011b atributu u\u017eivatelsk\u00e9ho \u00fa\u010dtu skript tak\u00e9 prov\u00e1d\u00ed zm\u011bny v atributu Department u\u017eivatelsk\u00e9ho po\u010d\u00edta\u010de, kter\u00fd u\u017eivatel\u00e9 obvykle m\u011bnit nemohou. Aby \u0159e\u0161en\u00ed fungovalo, autor navrhuje zm\u011bnit standardn\u00ed nastaven\u00ed zabezpe\u010den\u00ed pro objekty AD.\n <\/li>\n
    3. Form\u00e1t data z\u00e1vis\u00ed na nastaven\u00ed lokalizace na koncov\u00e9m za\u0159\u00edzen\u00ed, tak\u017ee z jednoho za\u0159\u00edzen\u00ed m\u016f\u017eeme z\u00edskat 10. listopadu 2018 14:53, zat\u00edmco z druh\u00e9ho 11\/10\/18 2:53 p.m.\n <\/li>\n<\/ol>\n

      Za \u00fa\u010delem odstran\u011bn\u00ed t\u011bchto nedostatk\u016f bylo provedeno n\u00e1sleduj\u00edc\u00ed.<\/p>\n

        \n
      1. GPO se linkuje nikoli k dom\u00e9n\u011b, ale k OU s po\u010d\u00edta\u010di (u\u017eivatele a po\u010d\u00edta\u010de rozd\u011bluji do r\u016fzn\u00fdch OU a doporu\u010duji to i ostatn\u00edm). P\u0159itom je nastavena re\u017eim zpracov\u00e1n\u00ed smy\u010dky<\/a><\/noindex> byl nastaven slou\u010dit<\/i>.\n <\/li>\n
      2. Skript bude ukl\u00e1dat data pouze do u\u017eivatelsk\u00e9ho \u00fa\u010dtu v atributu Info<\/i>, kter\u00fd si u\u017eivatel m\u016f\u017ee zm\u011bnit s\u00e1m pro sv\u016fj \u00fa\u010det.\n <\/li>\n
      3. Byl zm\u011bn\u011bn k\u00f3d generuj\u00edc\u00ed hodnotu atributu\n <\/li>\n<\/ol>\n

        Nyn\u00ed skripty vypadaj\u00ed takto:
        \nSaveLogonInfoToAdUserAttrib.vbs<\/b><\/p>\n

        On Error Resume Next\nSet wshShell = CreateObject(\"WScript.Shell\")\nstrComputerName = wshShell.ExpandEnvironmentStrings(\"%COMPUTERNAME%\")\nSet adsinfo = CreateObject(\"ADSystemInfo\")\nSet oUser = GetObject(\"LDAP:\/\/\" & adsinfo.UserName)\nstrMonth = Month(Now())\nIf Len(strMonth) < 2 then\n  strMonth = "0" & strMonth\nEnd If\nstrDay = Day(Now())\nIf Len(strDay) < 2 then\n  strDay = "0" & strDay\nEnd If\nstrTime = FormatDateTime(Now(),vbLongTime)\nIf Len(strTime) < 8 then\n  strTime = "0" & strTime\nEnd If\nstrTimeStamp = Year(Now()) & "\\\/" & strMonth & "\\\/" & strDay & " " & strTime\noUser.put "info", strTimeStamp & " \" & \" @ \" & strComputerName\noUser.Setinfo\n<\/code><\/pre>\n
        SaveLogoffInfoToAdUserAttrib.vbs<\/b><\/p>\n
        On Error Resume Next\nSet wshShell = CreateObject(\"WScript.Shell\")\nstrComputerName = wshShell.ExpandEnvironmentStrings(\"%COMPUTERNAME%\")\nSet adsinfo = CreateObject(\"ADSystemInfo\")\nSet oUser = GetObject(\"LDAP:\/\/\" & adsinfo.UserName)\nstrMonth = Month(Now())\nIf Len(strMonth) < 2 then\n  strMonth = "0" & strMonth\nEnd If\nstrDay = Day(Now())\nIf Len(strDay) < 2 then\n  strDay = "0" & strDay\nEnd If\nstrTime = FormatDateTime(Now(),vbLongTime)\nIf Len(strTime) < 8 then\n  strTime = "0" & strTime\nEnd If\nstrTimeStamp = Year(Now()) & "\\\/" & strMonth & "\\\/" & strDay & " " & strTime\noUser.put "info", strTimeStamp & " \" & \" @ \" & strComputerName\noUser.Setinfo\n<\/code><\/pre>\n
        \nKdo prvn\u00ed najde v\u0161echny rozd\u00edly mezi logon a logoff skriptem, tomu to p\u0159inese karma. \ud83d\ude42
        \nTak\u00e9 byl vytvo\u0159en tento mal\u00fd PS skript pro z\u00edsk\u00e1n\u00ed p\u0159ehledn\u00fdch informac\u00ed:
        \nGet-UsersByPCsInfo.ps1<\/b><\/p>\n
        $OU = \"OU=MyUsers,DC=mydomain,DC=com\"\nGet-ADUser -SearchBase $OU -Properties * -Filter * | Select-Object DisplayName, SamAccountName, info | Sort DisplayName | Out-GridView -Title \"Informace k p\u0159ihl\u00e1\u0161en\u00edm\" -Wait\n<\/code><\/pre>\n
        \nCelkov\u011b se v\u0161e nastavuje rychle:<\/p>\n
          \n
        1. vytvo\u0159\u00edme GPO s po\u017eadovan\u00fdmi nastaven\u00edmi a propoj\u00ed ho s odd\u011blen\u00edm pracovn\u00edch stanic u\u017eivatel\u016f:
          \n\"Windows:\n <\/li>\n
        2. jdeme si uva\u0159it \u010daj (pokud je AD s velk\u00fdm po\u010dtem u\u017eivatel\u016f, tak bude \u010daje pot\u0159eba mnoho \ud83d\ude42\n <\/li>\n
        3. spust\u00edme PS skript a dostaneme v\u00fdsledek:
          \n\"Windows:
          \nV horn\u00ed \u010d\u00e1sti okna je pohodln\u00fd filtr, ve kter\u00e9m je mo\u017en\u00e9 vyb\u00edrat data podle hodnot jednoho nebo v\u00edce pol\u00ed. Kliknut\u00ed na sloupce tabulky \u0159ad\u00ed z\u00e1znamy podle hodnot odpov\u00eddaj\u00edc\u00edch pol\u00ed.\n <\/li>\n<\/ol>\n
          Na\u0161e \u0159e\u0161en\u00ed lze \u201ehezk\u011b zabalit\u201c.
          \n\"Windows:
          \nK tomu p\u0159id\u00e1me z\u00e1stupce pro spu\u0161t\u011bn\u00ed skriptu technick\u00fdm specialist\u016fm, jeho\u017e pole \u201eobjekt\u201c bude m\u00edt n\u011bco takov\u00e9ho:
          \npowershell.exe -NoLogo -ExecutionPolicy Bypass -File \"servershareScriptsGet-UsersByPCsInfo.ps1\"
          \n<\/code>
          \nPokud je zam\u011bstnanc\u016f technick\u00e9 podpory hodn\u011b, m\u016f\u017eete rozdat z\u00e1stupce pomoc\u00ed           GPP<\/a><\/noindex>.<\/p>\n
          Na z\u00e1v\u011br n\u011bkolik pozn\u00e1mek.<\/p>\n