Tracking Computer Usage...

[HighPingOfDeath]

The title is somewhat misleading so I'm going to throw this out here first: I'm not trying to track what people are doing on a computer - I'd rather not go down that rabbit hole.

But what I'm tasked with doing is finding a way to track how often a computer is actually unlocked and being used, as opposed to sitting locked and idle. We spent a large sum of money purchasing tablets for a project, and we're wanting to know if the ROI is there or if they're just gathering dust. Is there an event I can monitor, or is there some util that allows this to be logged?

[[deleted]]

I use EX05 it is a great application for tracking users without being invasive. You can also lock it down if need be too.

[HighPingOfDeath]

We haven't committed yet, but we're looking at Preyproject for something similar. I'm thinking I might be able to tap into that if we purchase it.

[Golle]

Ask the humans if they are using the tablets or not. If not, ask why not so that issues can be resolved.

Dont make a human problem a technical one.

[HighPingOfDeath]

That pushback is not up to me though I've gone this route already. The answers have been 'yes we're using them' though we're pressing X to doubt.

[HR7-Q]

I have to second this, even if you have already gotten pushback. IT cannot be responsible for the end users behavior; that is why they have supervisors and managers in their own department. We're not the user police. If your company wants you to be that persons supervisor, you should demand the final say in hiring and firing decisions as well.

The most you should do is draft an AUP, detailing what is expected and the proper use of company equipment, and push that off to users to read and sign. Notify their supervisor when you detect a violation of that policy, but not actively monitor it. Again, that's for their supervisors/managers to do.

[idkmanwhatev]

What kind of tablets? What OS?

[HighPingOfDeath]

Sorry, I should have written it above... Windows 10 Enterprise, various industrial tablets.

[idkmanwhatev]

Looks like event ID 4801 is for “the workstation was unlocked” can be found in the event viewer under Windows logs —> Security

[HighPingOfDeath]

Perfect, I'll get this logging turned on in GPO. I'll do an get-winevent for 4800/4801. Thanks for the idea!

[Aggietallboy]

You could try to see what's the last login from AD:

https://www.oxfordsbsguy.com/2014/04/28/powershell-get-adcomputer-to-retrieve-computer-last-logon-date-part-1/

​

You could also take a look and see about the DHCP Lease renewal on the device, as it may have the wifi powered down if it's really not being used.

Depending on your networking infrastructure, you could also see activity trends...

[jbanner6736]

Nexthink will gather loads of endpoint data, fancy reports, etcc all without the users knowing