{"id":37887,"date":"2019-10-31T22:20:23","date_gmt":"2019-10-31T19:20:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/windows-uznayom-kto-gde-zaloginen\/"},"modified":"2019-10-31T22:20:23","modified_gmt":"2019-10-31T19:20:23","slug":"windows-uznayom-kto-gde-zaloginen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/windows-uznayom-kto-gde-zaloginen","title":{"rendered":"Windows: zis\u0165ujeme, kto je kde prihl\u00e1sen\u00fd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Windows:<\/a><\/noindex>
\n \u2014 Och, ni\u010d mi nefunguje, pom\u00f4\u017ete!
\n \u2014 Nez\u00fafajte, v\u0161etko \u010doskoro naprav\u00edme. Povedzte n\u00e1zov po\u010d\u00edta\u010da...
\n(klasika \u017e\u00e1nru z hovorov na technick\u00fa podporu)<\/p>\n

Dobre, ak m\u00e1te n\u00e1stroj a la BgInfo alebo va\u0161i u\u017e\u00edvatelia poznaj\u00fa kl\u00e1vesov\u00fa skratku Windows+Pause\/Break a vedia ju stla\u010di\u0165. Ob\u010das sa dokonca n\u00e1jdu aj vz\u00e1cne exempl\u00e1re, ktor\u00e9 sa nau\u010dili meno svojho stroja. Ale \u010dasto sa st\u00e1va, \u017ee volaj\u00faci okrem svojej hlavnej probl\u00e9my dostane aj druh\u00fa: zisti\u0165 meno\/IP adresu po\u010d\u00edta\u010da. A niekedy na vyrie\u0161enie tejto druhej probl\u00e9my potrebuje ove\u013ea viac \u010dasu ako na prv\u00fa (a pritom sta\u010dilo len zmeni\u0165 pozadie alebo vr\u00e1ti\u0165 zmiznut\u00fa skratku :)).
\nVe\u010f je omnoho pr\u00edjemnej\u0161ie po\u010du\u0165 nie\u010do ako:
\n \u2014 Tatiana Sergejevna, nebojte sa, u\u017e sa prip\u00e1jam...<\/p>\n

<\/a><\/noindex>
\nA na to netreba ani tak ve\u013ea.
\n\u0160pecialistovi technickej podpory sta\u010d\u00ed len ovl\u00e1da\u0165 men\u00e1 strojov a pam\u00e4ta\u0165 si, kto na akom pracuje.
\nPred popisom rie\u0161enia, ktor\u00e9 v s\u00fa\u010dasnosti pou\u017e\u00edvame, stru\u010dne presk\u00famam in\u00e9 mo\u017enosti, aby som ich kritizoval, vysvetlil svoj v\u00fdber.<\/p>\n

    \n
  1. BgInfo<\/a><\/noindex>, Desktop Info<\/a><\/noindex> a jemu podobn\u00e9. Ak m\u00e1te dostatok pe\u0148az\u00ed, existuj\u00fa aj platen\u00e9 verzie. Podstatou je, \u017ee na plochu sa zobrazuje technick\u00e1 inform\u00e1cia: meno stroja, IP adresa, prihl\u00e1senie a pod. V Desktop Info m\u00f4\u017eete dokonca zobrazi\u0165 grafy v\u00fdkonu na polovici obrazovky.
    \nNevyhovuje mi to, \u017ee pre Bginfo napr\u00edklad, u\u017e\u00edvate\u013e mus\u00ed minimalizova\u0165 okn\u00e1, aby videl potrebn\u00e9 \u00fadaje. Takisto sme s kolegami viackr\u00e1t pozorovali u BgInfo     charakteristick\u00fd artefakt<\/a><\/noindex>, ke\u010f sa nov\u00fd text zobrazuje na starom.
    \nNiekter\u00fdch u\u017e\u00edvate\u013eov roz\u010du\u013euje, \u017ee administr\u00e1tori radi kreslia desiv\u00e9 192.168.0.123 na tv\u00e1ri roz\u0161\u00edren\u00e9ho ma\u010dky na ploche, \u010do kaz\u00ed estetiku pozadia, a samozrejme, to stra\u0161ne demotivuje a \u00faplne zab\u00edja pracovn\u00fd el\u00e1n.\n <\/li>\n
  2. Skratka a la \u201eKto som\u201c (nesna\u017ete sa mu prida\u0165 ot\u00e1znik na konci :). Klasick\u00e1 skratka na ploche, za ktorou sa skr\u00fdva upratan\u00fd alebo nie ve\u013emi skript, ktor\u00fd zobrazuje potrebn\u00e9 inform\u00e1cie vo forme dial\u00f3gov\u00e9ho okna. Niekedy miesto skratky na pracovnej ploche umiestnia samotn\u00fd skript, \u010do IMHO nie je vkusn\u00e9.
    \nNev\u00fdhodou je, \u017ee na spustenie skratky, rovnako ako v prvom pr\u00edpade, je potrebn\u00e9 zminimalizova\u0165 v\u0161etky otvoren\u00e9 okn\u00e1 (rozmazn\u00e1va\u010d\u00ed osudu, ktor\u00ed maj\u00fa na pracovnej ploche otvoren\u00e9 jedin\u00e9 okno s solit\u00e9rmi, sa do \u00favahy neber\u00fa). Mimochodom, vedia va\u0161i pou\u017e\u00edvatelia, kam klikn\u00fa\u0165, aby zminimalizovali v\u0161etky okn\u00e1? Spr\u00e1vne, prstom do oka adminovi.\n <\/li>\n<\/ol>\n

    \nTaktie\u017e kapit\u00e1n nazna\u010duje, \u017ee oboch vy\u0161\u0161ie pop\u00edsan\u00fdch sp\u00f4sobov m\u00e1 hlavn\u00fd nedostatok v tom, \u017ee sa na z\u00edskan\u00ed inform\u00e1ci\u00ed podie\u013ea pou\u017e\u00edvate\u013e, ktor\u00fd m\u00f4\u017ee by\u0165 slabozrak\u00fd, hl\u00fapy a v\u00f4bec klama\u0165.
    \nMo\u017enos\u0165 so zvy\u0161ovan\u00edm po\u010d\u00edta\u010dovej gramotnosti, ke\u010f v\u0161etci vedia, kde v syst\u00e9me Windows n\u00e1js\u0165 n\u00e1zov svojho po\u010d\u00edta\u010da, sa nebudem zaobera\u0165: je to u\u0161\u013eachtil\u00e1 \u010dinnos\u0165, ale ve\u013emi n\u00e1ro\u010dn\u00e1. A ak m\u00e1 firma fluktu\u00e1ciu zamestnancov, tak je to predsa len m\u0155tve. \u010co tam u\u017e rozpr\u00e1va\u0165, vo v\u00e4\u010d\u0161ine pr\u00edpadov ani svoje prihlasovacie meno si nepam\u00e4taj\u00fa.<\/p>\n

    Vylial som du\u0161u, a teraz k veci.
    \nZ\u00e1kladom bol n\u00e1pad jedn\u00e9ho z u\u017e\u00edvate\u013eov z Habr.     mittel<\/a><\/noindex> z tohto \u010dl\u00e1nku<\/a><\/noindex>.
    \nPodstatou n\u00e1padu je, \u017ee pri prihl\u00e1sen\u00ed pou\u017e\u00edvate\u013ea do syst\u00e9mu Windows logon skript zaznamen\u00e1va potrebn\u00e9 inform\u00e1cie (\u010das a n\u00e1zov po\u010d\u00edta\u010da) do ur\u010dit\u00e9ho atrib\u00fatu u\u017e\u00edvate\u013esk\u00e9ho \u00fa\u010dtu. A pri odhl\u00e1sen\u00ed zo syst\u00e9mu sa vykon\u00e1va podobn\u00fd logoff skript.<\/p>\n

    Samotn\u00fd n\u00e1pad sa mi p\u00e1\u010dil, ale v realiz\u00e1cii mi niektor\u00e9 veci nevyhovovali.<\/p>\n

      \n
    1. Skupinov\u00e1 politika, v ktorej s\u00fa definovan\u00e9 logon a logoff skripty pre pou\u017e\u00edvate\u013eov, sa uplat\u0148uje na cel\u00fa dom\u00e9nu, tak\u017ee skripty sa spustia na akomko\u013evek po\u010d\u00edta\u010di, do ktor\u00e9ho sa pou\u017e\u00edvate\u013e prihl\u00e1si. Ak v r\u00e1mci va\u0161ich pracovn\u00fdch stan\u00edc pou\u017e\u00edvate aj termin\u00e1lov\u00e9 rie\u0161enia (napr\u00edklad Microsoft RDS alebo produkty Citrix), tak\u00fdto pr\u00edstup bude nepr\u00edjemn\u00fd.\n <\/li>\n
    2. \u00dadaje sa zaznamen\u00e1vaj\u00fa do atrib\u00fatu Department u\u017e\u00edvate\u013esk\u00e9ho \u00fa\u010dtu, ktor\u00fd m\u00e1 be\u017en\u00fd pou\u017e\u00edvate\u013e pr\u00edstup len na \u010d\u00edtanie. Okrem atrib\u00fatu u\u017e\u00edvate\u013esk\u00e9ho \u00fa\u010dtu skript tie\u017e vykon\u00e1va zmeny v atrib\u00fate Department po\u010d\u00edta\u010dov\u00e9ho \u00fa\u010dtu, ktor\u00fd pou\u017e\u00edvate\u013e nem\u00f4\u017ee meni\u0165. Preto, aby rie\u0161enie fungovalo, autor navrhuje zmeni\u0165 \u0161tandardn\u00e9 nastavenia zabezpe\u010denia pre objekty AD.\n <\/li>\n
    3. Form\u00e1t d\u00e1tumu z\u00e1vis\u00ed od nastaven\u00ed lokaliz\u00e1cie na koncovom po\u010d\u00edta\u010di, preto z jedn\u00e9ho po\u010d\u00edta\u010da m\u00f4\u017eeme dosta\u0165 10. november 2018 14:53, zatia\u013e \u010do z in\u00e9ho 11\/10\/18 2:53 p.m.\n <\/li>\n<\/ol>\n

      Na odstr\u00e1nenie t\u00fdchto nev\u00fdhod bolo vykonan\u00e9 nasledovn\u00e9.<\/p>\n

        \n
      1. GPO sa neodkazuje na dom\u00e9nu, ale na OU s po\u010d\u00edta\u010dmi (ja rozde\u013eujem pou\u017e\u00edvate\u013eov a po\u010d\u00edta\u010de do r\u00f4znych OU a odpor\u00fa\u010dam aj ostatn\u00fdm). Pri tom je pre re\u017eim spracovania slu\u010diek<\/a><\/noindex> nastaven\u00fd re\u017eim merge<\/i>.\n <\/li>\n
      2. Skript bude zapisova\u0165 \u00fadaje iba do pou\u017e\u00edvate\u013esk\u00e9ho konta v atrib\u00fate Info<\/i>, ktor\u00fd si pou\u017e\u00edvate\u013e m\u00f4\u017ee s\u00e1m meni\u0165 pre svoje konto.\n <\/li>\n
      3. Bol zmenen\u00fd \u00faryvok k\u00f3du generuj\u00faci hodnotu atrib\u00fatu\n <\/li>\n<\/ol>\n

        Teraz skripty vyzeraj\u00fa takto:
        \nSaveLogonInfoToAdUserAttrib.vbs<\/b><\/p>\n

        On Error Resume Next\nSet wshShell = CreateObject(\"WScript.Shell\")\nstrComputerName = wshShell.ExpandEnvironmentStrings(\"%COMPUTERNAME%\")\nSet adsinfo = CreateObject(\"ADSystemInfo\")\nSet oUser = GetObject(\"LDAP:\/\/\" & adsinfo.UserName)\nstrMonth = Month(Now())\nIf Len(strMonth) < 2 then\n  strMonth = "0" & strMonth\nEnd If\nstrDay = Day(Now())\nIf Len(strDay) < 2 then\n  strDay = "0" & strDay\nEnd If\nstrTime = FormatDateTime(Now(),vbLongTime)\nIf Len(strTime) < 8 then\n  strTime = "0" & strTime\nEnd If\nstrTimeStamp = Year(Now()) & "\\\/" & strMonth & "\\\/" & strDay & " " & strTime\noUser.put "info", strTimeStamp & " \" & \" @ \" & strComputerName\noUser.Setinfo\n<\/code><\/pre>\n
        SaveLogoffInfoToAdUserAttrib.vbs<\/b><\/p>\n
        On Error Resume Next\nSet wshShell = CreateObject(\"WScript.Shell\")\nstrComputerName = wshShell.ExpandEnvironmentStrings(\"%COMPUTERNAME%\")\nSet adsinfo = CreateObject(\"ADSystemInfo\")\nSet oUser = GetObject(\"LDAP:\/\/\" & adsinfo.UserName)\nstrMonth = Month(Now())\nIf Len(strMonth) < 2 then\n  strMonth = "0" & strMonth\nEnd If\nstrDay = Day(Now())\nIf Len(strDay) < 2 then\n  strDay = "0" & strDay\nEnd If\nstrTime = FormatDateTime(Now(),vbLongTime)\nIf Len(strTime) < 8 then\n  strTime = "0" & strTime\nEnd If\nstrTimeStamp = Year(Now()) & "\\\/" & strMonth & "\\\/" & strDay & " " & strTime\noUser.put "info", strTimeStamp & " \" & \" @ \" & strComputerName\noUser.Setinfo\n<\/code><\/pre>\n
        \nKto prv\u00fd n\u00e1jde v\u0161etky rozdiely medzi logon a logoff skriptom, tomu to prid\u00e1 plus do karmy. \ud83d\ude42
        \nTaktie\u017e bol vytvoren\u00fd tento mal\u00fd PS skript na preh\u013eadn\u00e9 inform\u00e1cie:
        \nGet-UsersByPCsInfo.ps1<\/b><\/p>\n
        $OU = \"OU=MyUsers,DC=mydomain,DC=com\"\nGet-ADUser -SearchBase $OU -Properties * -Filter * | Select-Object DisplayName, SamAccountName, info | Sort DisplayName | Out-GridView -Title \"Inform\u00e1cie o logonoch\" -Wait\n<\/code><\/pre>\n
        \nCelkovo sa v\u0161etko nastavuje r\u00fdchlo:<\/p>\n
          \n
        1. vytvor\u00edme GPO s po\u017eadovan\u00fdmi nastaveniami a prepoj\u00edme ho s oddelen\u00edm s pracovn\u00fdmi stanicami pou\u017e\u00edvate\u013eov:
          \n\"Windows:\n <\/li>\n
        2. ideme na \u010daj (ak je AD s ve\u013ek\u00fdm po\u010dtom pou\u017e\u00edvate\u013eov, \u010daju bude potrebn\u00e9 ve\u013ea \ud83d\ude42\n <\/li>\n
        3. spust\u00edme PS skript a z\u00edskame v\u00fdsledok:
          \n\"Windows:
          \nV hornej \u010dasti okna je pohodln\u00fd filter, v ktorom mo\u017eno triedi\u0165 \u00fadaje pod\u013ea hodn\u00f4t jedn\u00e9ho alebo viacer\u00fdch pol\u00ed. Kliknutie na st\u013apce tabu\u013eky usporiada z\u00e1znamy pod\u013ea hodn\u00f4t pr\u00edslu\u0161n\u00fdch pol\u00ed.\n <\/li>\n<\/ol>\n
          Na\u0161e rie\u0161enie m\u00f4\u017eeme pekne \u201ezabali\u0165\u201c.
          \n\"Windows:
          \nNa to prid\u00e1me skratku na spustenie skriptu technick\u00fdm pracovn\u00edkom, kde v poli \"objekt\" bude nie\u010do tak\u00e9to:
          \npowershell.exe -NoLogo -ExecutionPolicy Bypass -File \"servershareScriptsGet-UsersByPCsInfo.ps1\"
          \n<\/code>
          \nAk je ve\u013ea zamestnancov technickej podpory, m\u00f4\u017eete rozda\u0165 skratku pomocou           GPP<\/a><\/noindex>.<\/p>\n
          Nieko\u013eko pozn\u00e1mok na z\u00e1ver.<\/p>\n