How can we pull a list of websites accessed by a particular user?

Our network has a windows 2011 server acting as our DNS and DHCP server.  Is there anyway to generate a report in windows SBS 2011 that would show which user went to which website?  Or would we need a specialized firewall/proxy software to be able to do that?
clloccAsked:
Who is Participating?
 
philkeeneConnect With a Mentor Commented:
We used the nirsoft software to output files to a network location using the command line tools and scripting. I don't know if the historyviewer program can do the same but if so you could review it from wherever you want.
0
 
aindelicatoCommented:
Only if you have a proxy logging your URL traffic.

What router do you have to the internet? Some have logging options, probably not turned on by default.


There's always the user's browser history.
0
 
philkeeneConnect With a Mentor Commented:
How about using group policies to disable the delete history button and such like.

Then use something like...

http://www.nirsoft.net/utils/iehv.html

... with it's command line tools, in the user's log on script.

Very low cost solution to the problem.
0
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

 
clloccAuthor Commented:
We have a standard linksys router which I'm sure can do logging but it probably can't tell which user went to which website, just a general url list accessed by all users on our network.

It seems the nirsoft utility is the closest thing that would let us view the URLs a certain user has accessed but, as you said, it would require some work to setup a GP to disable the delete history button.

Thanks
0
 
philkeeneCommented:
Yeah I guess that's the balance... the solution I gave you is low cost but will involve some configuration, and isn't 100% perfect. The alternative would be a proxy server or something like www.spectorsoft.com which would certainly be higher cost but is more sophisticated and provides other useful features too.

Hope this helps.
0
 
clloccAuthor Commented:
phil, a side question: do you know if spectorsoft offers proxy server service?
0
 
jcimarronConnect With a Mentor Commented:
cllocc--Never tried it on a server. History Viewer
http://www.historyviewer.net/
It should not hurt.  Note the options in left panel tree.  URL History has most data.

Or read directly the index.dat file in Content. IE5
( C:\Users\Username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 .  Content.IE5 is a hidden file so unhide it.)
You will also need an index.dat reader
http://www.acesoft.net/index.dat%20viewer/index.dat_viewer.htm
0
 
philkeeneCommented:
I don't believe spectorsoft does, but it does offer blocking of particular sites, monitoring of sites accessed, as well as screen shots of the user's screen, key logger, etc. There are a lot of good features, but it is expensive...
0
 
clloccAuthor Commented:
That historyviewer program is almost what our management is looking for.  If only it could be configured to view history on all the machines on our network from a central workstation.
0
 
jcimarronConnect With a Mentor Commented:
cllocc--Certainly you could install History Viewer on each machine.  Now you would have to be able to access each machine, open History Viewer and send the results to you.  I would feel a good programmer could do that.  Regrets that I am not a programmer.
0
 
clloccAuthor Commented:
Thanks for the suggestions
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.