SteveWH's Posts

SteveWH · ‎04-18-2017

Good morning, Thank you for taking a look at my issue. I also believed it was timing related and added a static sleep of 20, 40, up to 60 seconds but it never logged the values of the environm...

Good morning, Thank you for taking a look at my issue. I also believed it was timing related and added a static sleep of 20, 40, up to 60 seconds but it never logged the values of the environmental variables. I confirmed the values existed manually once logged in so I'm not sure why the script can't see them but the user can. I also found those volatile registry keys and tried referencing those instead of the variables but the script doesn't pull them either. Based on your recommendation I tried adding a loop sleep instead of a static 60 second but it never completes and loops forever. When I manually run my script as well as the one you provided they do log the desired information successfully so there is no issue with the scripts themselves. I even tried adding a 'launcher' vbs script that sleeps and then launches a child VBS script with our actual payload but that doesn't work either. It's as if the logon scripts may be running under a different context that doesn't have access to the HKCU or Volatile Variables. Is that a setting in UEM that you know of? Maybe it is running as SYSTEM instead of the user?

SteveWH · ‎04-13-2017

We have a Horizon View 7 VDI environment with non-persistent floating pools. We are interested in maintaining a log of the following user events: logon, logoff, disconnect, reconnect, lock, and u...

We have a Horizon View 7 VDI environment with non-persistent floating pools. We are interested in maintaining a log of the following user events: logon, logoff, disconnect, reconnect, lock, and unlock. Since UEM has the ability to execute scripts when these triggers are detected we created custom VBS scripts for each event that will write the event name, username, VM name, date, time, client name, client IP, connection server name, and connection protocol to a log file on a network share. The problem we are encountering is that the ViewClient related environmental variables aren't always available in the VM when UEM detects the event and launches the script. This results in the script recording the variable name instead of the value. I'm starting this discussion to see if there is another location we can obtain this data. I have attached an example trigger XML file, VBS script, and an event log file showing the problem.

All

SteveWH's Posts

Re: Leveraging UEM to maintain a user activity log of logon, logoff, disconnect, reconnect, lock, unlock

Leveraging UEM to maintain a user activity log of logon, logoff, disconnect, reconnect, lock, unlock