User logon session auditing with Quest InTrust

Thanks for watching this short video. My name is Brian Hymer. I'm a solutions architect with Quest Software. I want to show you a report that we have in our InTrust product which allows you to see how long people are actively working at their workstations. We call it user session auditing. And we have two reports. I'll just drill down in here. You can see users' session logins durations by day and users' login session duration by week. I'm going to focus on the weekly report. Now, a user session is started when a user logs on or, say, unlocks their workstation. And it ends when a user's workstation gets locked or they log off or maybe the screensaver comes on or the computer gets rebooted. Every session that happens during the day has a start time and an end time and a duration. And this report will actually take all of the durations from a week and add them up to tell you how many hours that user was actively in front of their workstation for the week. You can see here it defaults to four weeks. Let's just change that to-- I have other filters here. I could pick-- well, let's see. Did I set that right? Yeah, good. I could pick computers. All of the computers that my users use are VDIs. And they all start with the name [? tcorp. ?] So I'll put [? tcorp ?] and then a percent sign because that's the wild card in SQl. And we are using SQL Reporting Services behind the Quest Knowledge Portal. And then I'll switch here to our Miscellaneous tab where there's a bunch of other filters. I like to not show my filters in the header of the report, so I'll take that out. And I might-- maybe I want to read this for a department. So I might want to use username. And then I might need a file with maybe a group membership. I have one that I created ahead of time. It's in my Temp Directory. So I'll just drill into my Temp Directory. You can see here it is, mygroup.text. So I'll Double-Click on that and make sure I pick Import from File and click OK. And now you can see the handful of users I'm going to run this against. OK, everything is set. That looks good. Let's take a look at the report. Now, when we create this report, it does show details by default. So I can see here from Sunday, March 8 to Saturday, March 14 I had nine hours and 13 minutes of time. This is my user account. Now, I might not need the details. So let's do that. Let's turn details off. So I'm just going to come back here to my Miscellaneous tab. Here's this Show Details. I'll turn that off. And we'll run this report one more time. And now I can see very clearly and concisely that only three of the six people I had in that group actually did work, and they worked some pretty dismal hours. Now, OK, this is just a lab. We don't really need to worry about how long people were actually in front of these machines. But maybe that's important for you and maybe you've set a threshold. Maybe you want to make sure people are working at least eight hours a day. So I'll go ahead and go here and export this data out to a CSV. And when I do that, all the detailed events are going to show up again as well in the CSV. And so here you can see all of the events. I'll just highlight here and resize my columns. There we go. This duration time total is what I really want to focus on. So I'm going to click on Data and then hit this little funnel icon to create filters for each. And then here I could create a number filter and say, show me any results where it's less than eight hours, so 08 colon 00 colon 00. That's eight hours. And you can see here some users that did-- and only two of my users had a week where they didn't do more than eight hours of work. So maybe this is what you'd want for your manager. Maybe give those people a call, or just understand why their activity on their computers was less than you'd expect. That's what I had to show for today. I hope that was good information. Thanks for watching.