tis-audit-user-logon-logoff

package           : tis-audit-user-logon-logoff
version           : 0-0
architecture      : all
section           : base
priority          : optional
name              : 
categories        : audit
maintainer        : WAPT Team,Tranquil IT
description       : This package audits user logon and logoff events on the workstation. It collects Windows session connection and disconnection events and stores them in WAPT audit data for tracking and reporting purposes.
depends           : 
conflicts         : 
maturity          : PROD
locale            : all
target_os         : windows
min_wapt_version  : 
sources           : 
installed_size    : 
impacted_process  : 
description_fr    : Ce paquet audite les événements de connexion et de déconnexion utilisateur sur le poste. Il collecte les événements Windows d’ouverture et de fermeture de session, puis les enregistre dans les données d’audit WAPT à des fins de suivi et de reporting.
description_pl    : 
description_de    : 
description_es    : 
description_pt    : 
description_it    : 
description_nl    : 
description_ru    : 
audit_schedule    : 
editor            : 
keywords          : 
licence           : 
homepage          : 
package_uuid      : 88c56cc5-d95c-4320-9d96-18642835b2bf
valid_from        : 
valid_until       : 
forced_install_on : 
changelog         : 
min_os_version    : 
max_os_version    : 
icon_sha256sum    : 73dadb2386b7fb7a69f22de99b5f9edfd055336b3dd56d499fc544614c09da0f
signer            : Tranquil IT
signer_fingerprint: 8c5127a75392be9cc9afd0dbae1222a673072c308c14d88ab246e23832e8c6bb
signature_date    : 2026-06-17T15:06:04.000000
signed_attributes : package,version,architecture,section,priority,name,categories,maintainer,description,depends,conflicts,maturity,locale,target_os,min_wapt_version,sources,installed_size,impacted_process,description_fr,description_pl,description_de,description_es,description_pt,description_it,description_nl,description_ru,audit_schedule,editor,keywords,licence,homepage,package_uuid,valid_from,valid_until,forced_install_on,changelog,min_os_version,max_os_version,icon_sha256sum,signer,signer_fingerprint,signature_date,signed_attributes
signature         : ZEQV5g9WXI+6DdzsFSYM1htHF2MS+yv+Fln/GYGd4H89ibfWor0SS5TQtn/kXjcsCuU11bGrvmBbNB1u0X5f3jhhoCUo5RxrViYCn4zRilwOuSHbXfuIIq8/qKAdjGT6rnd2cMHHkI600ufRtC6cgqTbhb1dyRX9iPcw/V+BZZEEth5puxABRnc+3X+6c4EAOE0cprf3DgpH5BtyYZ6YEv0/HNNIP/k5kS/fpQMZ5zzQcX97g7it6ogkCfJTGM3uRj9WzXbg/emFSYCjB43eNH8IoD4x352FInYFg0/siQxOS5CRxYHPiFQdE5Gsg/U6zb21ZwXtXqYmOqEvqhdJrg==

# -*- coding: utf-8 -*-
from setuphelpers import *
import wmi
from datetime import datetime, timedelta
import calendar

def install():

    run(r'AUDITPOL /SET /SUBCATEGORY:"{0CCE9215-69AE-11D9-BED3-505054503030}" /SUCCESS:ENABLE /FAILURE:ENABLE')
    run(r'AUDITPOL /SET /SUBCATEGORY:"{0CCE9216-69AE-11D9-BED3-505054503030}" /SUCCESS:ENABLE /FAILURE:ENABLE')


def audit():

    name_key = "logon-logoff"

    wmi_o = wmi.WMI('.')

    v = WAPT.read_audit_data(name_key,name_key,include_expired_data=False)

    if not v:
        since = datetime.utcnow() - timedelta(days=3650)
    else:
        since = datetime.fromisoformat(v['date_utc'])

    since_wmi = since.strftime('%Y%m%d%H%M%S.000000+000')
    wql = ("SELECT * FROM Win32_NTLogEvent WHERE Logfile="
           "'System' AND (EventCode='7001' OR EventCode='7002') "
           "AND TimeGenerated >= '%s'" % since_wmi)

    # Query WMI object.
    wql_r = wmi_o.query(wql)
    wql_r.reverse()

    for event in wql_r:
        sid = list(event.InsertionStrings)[1]
        if not sid.startswith('S-1-5'):
            continue

        username = get_user_from_sid(sid)
        if username.strip() == "" or not username:
           continue

        if event.EventCode == 7001:
            typeevent = 'User-Connect'
        else:
            typeevent = 'User-Disconnect'

        realdate = event.TimeGenerated.split('.')[0]
        humandate = datetime.strptime(realdate, '%Y%m%d%H%M%S')
        humandate_now = datetime.fromtimestamp(calendar.timegm(humandate.timetuple()))

        WAPT.write_audit_data(
            name_key,
            name_key,
            value={
                "username": username,
                "date_utc": humandate,
                "date_now" : humandate_now,
                "typeevent": typeevent,

            },
            keep_days=3650,
            value_date=humandate,
            max_count=None
        )

    return "OK"

38d056ab130f7bf7c481c12636a4e9959de36561d3dfcbe54c6e3571bc0c1dc3 : WAPT/certificate.crt
6126bec6583677c40607dae9cf8957622f88251ee2d54ea68a1535a1d2836b72 : WAPT/control
73dadb2386b7fb7a69f22de99b5f9edfd055336b3dd56d499fc544614c09da0f : WAPT/icon.png
411f321a0290665e8e0c08363b4817a79bf278de0bc4fd534ccbb3e34cf051a7 : luti.json
e7f419f2362954da7a1d8b1a10851f36a7a8e7da136b300481536836dd8c0487 : setup.py