WO2010007990A1 - Device management system - Google Patents

Abstract

Provided is a device management system capable of allowing a monitoring server to monitor each operation history in business computers to reliably prevent a dishonest act by an employee. The device management system is formed from a plurality of business computers (10A, 10B, 10C) used by employees, a management computer (12) managed and maintained by the administrator in a company, and a monitoring server (13) for monitoring the terminal device business computers (10A, 10B, 10C) in chronological order.  A user level operation history acquiring application that allows the monitoring server (13) to acquire the user level operation history of when the computers (10A, 10B, 10C) execute an operation executable at a user level is installed in the business computers (10A, 10B, 10C).  The user level operation history acquiring application is registered in invisible start-up registries in the computers (10A, 10B, 10C).

Description

Equipment management system

The present invention relates to a device management system including a plurality of terminal devices and a device monitoring server that monitors the terminal devices in time series.

There is a network security system in which a network user detects an unauthorized intruder into a server via the Internet, notifies the Internet service provider of this, and reversely detects an unauthorized intruder in cooperation with the service provider (patent) Reference 1). This system identifies a monitoring terminal that detects and notifies unauthorized access using the Internet, and identifies an access source of the unauthorized access detected in response to the notification from the monitoring terminal. And a center terminal that notifies the user.

In addition, a device management system that includes a plurality of terminal devices and a monitoring server that is connected to a network formed by the terminal devices and monitors the terminal devices in a time series, and that prevents unauthorized actions of the terminal devices in the network. Yes (see Patent Document 2). The monitoring server includes an operation prohibiting unit that prohibits execution of non-permitted operations other than those permitted for the terminal devices, and a permitted operation history storage unit that stores a permitted operation history when the terminal device executes a permitted operation. And a non-permitted operation history storage unit that stores a non-permitted operation history when these terminal devices execute a non-permitted operation, and a history output unit that outputs a permitted operation history and a non-permitted operation history.

JP 2005-128919 A JP 2007-241513 A

The network security system disclosed in Patent Document 1 detects unauthorized access to the server on the user side by the monitoring terminal analyzing the log, and notifies the center terminal of the unauthorized access detection together with the stored log. The center terminal identifies an unauthorized access server from the notified log information, and notifies the user monitoring terminal of the access source server information. In this network security system, it is not necessary for a network user to specify an access source server for unauthorized access, and the labor and labor of the user are reduced accordingly. However, since the operation status of the permitted operation and the operation status of the non-permitted operation in each terminal device cannot be grasped, it is difficult to prevent fraudulent acts such as data tampering and data destruction by the network user.

The device management system disclosed in Patent Document 2 can grasp the operation status of the permitted operation and the operation status of the non-permitted operation in each terminal device. Each terminal device is installed with an operation history acquisition application that causes the monitoring server to acquire an operation history in the terminal device. In this system, since the operation history acquisition application is registered in the visible startup registry, the operation history acquisition application can be prevented from being activated in the terminal device. Specifically, by displaying a startup check box for the operation history acquisition application on the display and unchecking the check box, the operation history acquisition application can be prevented from starting when the terminal device is started. If the operation history acquisition application is not started, each operation history in the terminal device cannot be acquired by the monitoring server, and an illegal act of a network user using the terminal device cannot be prevented.

An object of the present invention is to provide a device management system in which each operation history in a terminal device can be monitored by a monitoring server, and illegal actions by network users can be surely prevented.

The premise of the present invention for solving the above-described problem is that the device includes a plurality of terminal devices used by a user, and a monitoring server connected to a network formed from the terminal devices and monitoring the terminal devices in time series. It is a device management system.

As a feature of the present invention based on the premise, the terminal device is installed with a user level operation history acquisition application that causes the monitoring server to acquire a user level operation history when the terminal device executes an operation that can be executed at the user level. The level operation history acquisition application is registered in an invisible startup registry in the terminal device.

As an example of the present invention, a system level operation history acquisition application that causes a monitoring server to acquire a system level operation history when the terminal device executes an operation that can be executed at the system level is installed in the terminal device. The acquisition application is registered in a task that is difficult to see in the terminal device.

As another example of the present invention, operations that can be performed at the user level include use operations within the operation permission time of those terminal devices in the network, use operations outside the operation permission time of these terminal devices in the network, and other than the network Use operation of these terminal devices in the external environment of the user, the user level operation history is a use operation history within the operation permission time of those terminal devices in the network, and a use operation history outside the operation permission time of these terminal devices in the network And a use operation history of those terminal devices in an external environment other than the network.

As another example of the present invention, operations that can be performed at the user level include use operations of permitted applications of the terminal devices, installation operations of various applications of the terminal devices, and uninstallation operations of the various applications of the terminal devices. The user-level operation history is the usage operation history of the permitted applications of these terminal devices, the installation operation history of various applications of these terminal devices, and the uninstall operation history of various applications of these terminal devices.

As another example of the present invention, operations that can be executed at the system level are start / end operations of these terminal devices, printing operations in these terminal devices, and operations for accessing files used in these terminal devices. The system level operation history is the start / end operation history of the terminal devices, the print operation history of the terminal devices, and the access operation history of the files used in the terminal devices.

As another example of the present invention, the system level operation history includes a print operation history in a terminal device in which data printing is prohibited among those terminal devices, and a terminal device in which data take-out among these terminal devices is prohibited. These are the data take-out operation history and the activation operation history of the movement prohibited application in those terminal devices.

According to the device management system of the present invention, a user-level operation history acquisition application that causes a monitoring server to acquire a user-level operation history when a terminal device executes an operation that can be executed at the user level is invisible in the terminal device. Therefore, the activation check box for the operation history acquisition application cannot be unchecked, and the user level operation history acquisition application cannot be activated when each terminal device is activated. Therefore, the monitoring server can reliably acquire an operation history of operations that can be executed at the user level from each terminal device. In this system, when each terminal device executes an operation that can be executed at the user level, the operation history is centrally managed by the monitoring server, and the user level operation history of each terminal device can be collated and monitored in the server. Therefore, it is possible to reliably prevent an illegal act such as data falsification or data destruction by a network user.

A device management system in which a system level operation history acquisition application that causes a monitoring server to acquire a system level operation history when a terminal device executes an operation that can be executed at the system level is registered in a task that is difficult to see in the terminal device is It becomes difficult to clear the check box of the acquisition application activation check box, and the system level operation history acquisition application cannot be deactivated when each terminal device is activated. Therefore, the monitoring server can reliably acquire an operation history of operations that can be executed at the system level from each terminal device. In this system, when each terminal device executes an operation that can be executed at the system level, the operation history is centrally managed by the monitoring server, and the server can collate and monitor the system level operation history of each terminal device. Therefore, it is possible to reliably prevent an illegal act such as data falsification or data destruction by a network user.

As the user level operation history, the operation content history within the operation permission time of those terminal devices in the network, the operation content history outside the operation permission time of these terminal devices in the network, the operation content history of these terminal devices in the external environment other than the network In the included device management system, since the monitoring server acquires the operation history within the operation permission time or outside the operation permission time of each terminal device in time series, the operation history within the operation permission time or outside the operation permission time is stored in the monitoring server. Centrally managed, it is possible to grasp the operation status within the operation permission time of the terminal device and outside the operation permission time via the monitoring server. Since the monitoring server acquires the operation history of the terminal device in the external environment other than the network in time series, the operation history in the external environment is centrally managed in the monitoring server, and the operation of the external environment of the terminal device is performed via the monitoring server. The situation can be grasped. This system can identify not only the use of the terminal device within the operation permission time but also the terminal device used outside the operation permission time or in the external environment, and unauthorized use of important data and confidential data by network users. Unauthorized acts such as take-out, falsification, and destruction can be reliably controlled.

The device management system including the usage operation history of permitted applications of these terminal devices, the installation operation history of various applications of these terminal devices, and the uninstall operation history of various applications of these terminal devices as the user level operation history Since the usage operation history of the permitted application of each terminal device is acquired in time series, the usage operation history of the permitted application is centrally managed in the monitoring server, and the usage operation status of the permitted application of the terminal device is grasped via the monitoring server. And can limit the unlimited use of the application. In the system, since the monitoring server acquires the installation operation history and uninstallation operation history of various applications of the terminal device in time series, the installation operation history and uninstallation operation history are centrally managed in the monitoring server, and the terminal is connected via the monitoring server. It is possible to grasp the installation operation status and uninstallation operation status of the device. Since this system can identify a terminal device that has performed various application installation operations and various application uninstallation operations, it can regulate unnecessary application installation actions by network users. Unauthorized uninstallation of applications can be restricted.

As the system level operation history, the device management system including the start / end operation history of each terminal device, the printing operation history in each terminal device, and the access operation history to the file used in each terminal device is Since the start / end operation history of the terminal device is acquired in time series, the start / end operation history of the terminal device is centrally managed in the monitoring server, and the start / end operation status of the terminal device can be grasped via the monitoring server. In the system, since the monitoring server acquires the printing operation history of each terminal device in time series, the printing operation history of the terminal device is centrally managed in the monitoring server, and the printing operation status of the terminal device is grasped via the monitoring server. Can do. Since this system can grasp the terminal device that performed the printing action using the printing action history, it regulates unauthorized actions such as unauthorized printing or taking-out of important data and confidential data by network users. be able to.

In this system, since the monitoring server acquires the access operation history to the file of each terminal device in time series, the access operation history to the file of the terminal device is centrally managed in the monitoring server, and the terminal device It is possible to grasp the status of file access operations. Since the system can grasp the terminal device that has accessed the file using the file access operation history, it is possible to regulate illegal acts such as unauthorized removal, falsification, and destruction of a predetermined file by a network user.

As the system level operation history, the printing operation history in the terminal device where data printing is prohibited among the terminal devices, the data carrying-out operation history in the terminal device where data taking-out is prohibited in the terminal device, the non-permitted application in the terminal device In the device management system including the activation operation history, since the monitoring server acquires the printing operation history in the terminal device not permitted to print data in time series, the printing operation history in the terminal device is centrally managed in the monitoring server, and the monitoring server Through this, it is possible to grasp the printing operation status in the terminal device that is not permitted to print data. Since this system can grasp the terminal device that is not allowed to print data using the printing operation history, it regulates unauthorized acts such as unauthorized printing of a predetermined file or unauthorized removal by a network user. be able to.

In this system, since the monitoring server obtains the data take-out operation history in the terminal device not permitted to take out data in time series, the data take-out operation history in the terminal device is centrally managed in the monitor server, and the data take-out operation is performed via the monitor server. It is possible to grasp the data take-out operation status in the unauthorized terminal device. Since the system can grasp the terminal device that is not allowed to take out data using the data take-out operation history, it regulates unauthorized actions such as unauthorized browsing of the specified data and unauthorized take-out by network users can do.

In this system, since the monitoring server acquires the activation operation history of the prohibited operation application in the terminal device in time series, the activation operation history of the prohibited operation application in the terminal device is centrally managed in the monitoring server, and the terminal is connected via the monitoring server. It is possible to grasp the activation operation status of the movable prohibition application in the apparatus. Since the system can grasp the terminal device that has performed the activation operation of the movement prohibited application using the movement operation history of the movement prohibited application, it is possible to suppress the access action to the movement prohibited application in each terminal device.

The block diagram of the apparatus management system shown as an example. The figure of the display screen of the authentication procedure displayed on the display of a computer. The figure which shows an example of start / end operation history, use operation history within operation permission time, use operation history of permission application. The figure which shows an example of start / end operation history, use operation history within operation permission time, use operation history of permission application. The figure which shows an example of the use operation log | history outside operation permission time, and the use operation log | history outside operation permission time of a permission application. The figure which shows an example of the use operation log | history outside operation permission time, and the use operation log | history outside operation permission time of a permission application. The figure which shows an example of the use operation log | history of those computers in external environments other than a network. The figure which shows an example of the use operation log | history of those computers in external environments other than a network. The figure which shows an example of the installation operation log | history of an application. The figure which shows the content of the installed application. The figure which shows an example of the uninstallation operation log | history of an application. The figure which shows the content of the uninstalled application. FIG. 6 is a diagram illustrating an example of a printing operation history. FIG. 6 is a diagram illustrating an example of a printing operation history. The figure which shows an example of a file access history. The figure which shows an example of a file access history. The figure which shows an example of a printing action log | history. The figure which shows an example of a printing action log | history. The figure which shows an example of a taking-out action log | history. The figure which shows an example of a taking-out action log | history. The figure which shows an example of the access history of a movement prohibition application. The figure which shows an example of the access history of a movement prohibition application.

Details of the device management system according to the present invention will be described below with reference to the accompanying drawings. FIG. 1 is a configuration diagram of a device management system 10 shown as an example. The equipment management system 10 includes a plurality of business computers 11A, 11B, and 11C (terminal devices) used by employees (users) for company work, a management computer 12 managed and stored by an in-house manager, and monitoring. The server 13 and the hub 14 connecting them are formed. The computers 11A, 11B, 11C, and 12 and the server 13 are connected to each other through a high-speed broadband line via a hub 14 to form an in-house network 15.

The monitoring server 13 monitors various operation states of the business computers 11A, 11B, and 11C logged into the network 15 in time series while the system 10 is in operation, and reports these operation states to the management computer 12. The business computers 11A, 11B, and 11C, the management computer 12, and the monitoring server 13 can be connected to the Internet and have an e-mail transmission / reception function. Further, the computers 11A, 11B, 11C, and 12 and the server 13 can access a predetermined Web site and log in to that site, and can access a predetermined external network and log in to that network.

In the network 15 formed from the computers 11A, 11B, 11C, 12 and the server 13, although not shown, a DNS server and a homepage for setting a correspondence between a host name and an IP address assigned to the host name are disclosed. Web server, database server that provides functions to read and write various data by accepting requests from other business computers and other servers, mail server for sending and receiving e-mails, created text and images Are connected to a server group such as a document server that stores all the data such as. The system 10 can be used for all networks such as a local area network and a wide area network. In addition, all existing network connection methods such as a bus network, a star network, a peer-to-peer network, and a ring network can be supported.

The business computers 11A, 11B, and 11C and the management computer 12 are connected to input devices such as a keyboard and a mouse, and output devices such as displays 16 and 17 and printers 18 and 19 via an interface (wired or wireless). Yes. Existing removable disks such as memory sticks, IC recorders, PDAs, and mobile phones can be detachably connected to the computers 11A, 11B, 11C, and 12, and the computers 11A, 11B, 11C, and 12 Various data can be exchanged between them.

User level operation history acquisition that causes the monitoring server 13 to acquire user level operation history when the computers 11A, 11B, and 11C execute operations that can be executed at the user level is stored in the memory of each business computer 11A, 11B, and 11C. An application (agent application) is installed. The business computers 11A, 11B, and 11C start a user level operation history acquisition application stored in the memory based on control by the operating system, and output the user level operation history to the monitoring server 13 according to the application.

The user level operation history acquisition application is registered in the invisible startup registry of the business computers 11A, 11B, and 11C. Therefore, the user level operation history acquisition application cannot be displayed on the display 16 in the business computers 11A, 11B, and 11C (invisible), and the contents of the user level operation history acquisition application cannot be confirmed (viewed). In these business computers 11A, 11B, and 11C, the activation check box of the user level operation history acquisition application cannot be displayed on the display 16. Therefore, by removing the check box, the computers 11A, 11B, and 11C It is not possible to prevent the user level operation history acquisition application from being activated at the time of activation.

The operations that can be performed at the user level include use operations within the operation permission time of the business computers 11A, 11B, and 11C in the network 15, use operations outside the operation permission time of the computers 11A, 11B, and 11C in the network 15, Use operation of the computers 11A, 11B, and 11C in an external environment other than the network 15, use operation of permitted applications of the computers 11A, 11B, and 11C, installation operation of various applications of the computers 11A, 11B, and 11C, the computers 11A, There is an uninstall operation for various applications of 11B and 11C.

The user level operation history includes the use operation history within the operation permission time of the business computers 11A, 11B, and 11C in the network 15, the use operation history outside the operation permission time of the computers 11A, 11B, and 11C in the network 15, the network Use operation history of the computers 11A, 11B, and 11C in an external environment other than 15, use operation history of permitted applications of the computers 11A, 11B, and 11C, installation operation history of various applications of the computers 11A, 11B, and 11C, and the computers There is an uninstall operation history of various applications 11A, 11B, and 11C.

System level operation history acquisition that causes the monitoring server 13 to acquire a system level operation history when the computers 11A, 11B, and 11C execute operations that can be executed at the system level is stored in the memory of each business computer 11A, 11B, and 11C. An application (agent application) is installed. The business computers 11A, 11B, and 11C start a system level operation history acquisition application stored in the memory based on the control by the operating system, and output the system level operation history to the monitoring server 13 according to the application.

The system level operation history acquisition application is registered in a task that is difficult to see on the business computers 11A, 11B, and 11C. Therefore, it is difficult to display the system level operation history acquisition application on the display 16 in these business computers 11A, 11B, and 11C (it is difficult to see), and it is possible to confirm (view) the contents of the system level operation history acquisition application. difficult. In these business computers 11A, 11B, and 11C, it is difficult to display the startup check box of the system level operation history acquisition application on the display 16. Therefore, by unchecking the check box, the computers 11A, 11B, The system level operation history acquisition application cannot be disabled when 11C is started.

The operations that can be performed at the system level include start / end operations of the business computers 11A, 11B, and 11C, printing operations on the computers 11A, 11B, and 11C, and access to files used on the computers 11A, 11B, and 11C. There is an operation. The system level operation history includes start / end operation histories of the computers 11A, 11B, and 11C, print operation histories in the computers 11A, 11B, and 11C, access operation histories to files used in the computers 11A, 11B, and 11C, Of these computers 11A, 11B, and 11C, the printing operation history in the computers 11A, 11B, and 11C in which data printing is prohibited, and in the computers 11A, 11B, and 11C in which data take-out among these computers 11A, 11B, and 11C is prohibited There are data take-out operation histories and activation operation histories of the movable prohibited applications in the computers 11A, 11B, and 11C.

The monitoring server 13 is a computer having a central processing unit and a memory, and is equipped with a large-capacity hard disk. The monitoring server 13 is installed with a user level operation history acquisition application (agent application) and a system level operation history acquisition application (agent application). Based on the control by the operating system, the monitoring server 13 activates those applications stored in the instruction file in the memory, and executes each means described later according to the applications.

FIG. 2 is a diagram of a display screen of the authentication procedure displayed on the business computers 11A, 11B, 11C and the displays 16, 17 of the management computer 12. The monitoring server 13 authenticates the computers 11A, 11B, 11C, and 12 when the business computers 11A, 11B, and 11C and the management computer 12 are activated. In the authentication, the computers 11A, 11B, 11C, and 12 are logged into the network 15, and it is determined whether or not the computers 11A, 11B, 11C, and 12 can be used in the network 15. Although the authentication method performed by the monitoring server 13 is password authentication, fingerprint authentication, voiceprint authentication, retina authentication, and IC card authentication can also be performed in addition to password authentication. As the password authentication, a one-time password can be adopted. When the computers 11A, 11B, 11C, and 12 are started up, as shown in FIG. 2, a user name input area and a password input area are displayed on the displays 16 and 17. Employees and managers enter user names and passwords in these input areas.

The monitoring server 13 compares the input user name and password with those stored in the memory, and determines whether the user name and password are correct or incorrect. If the user name and password are correct and the authentication result is valid, the monitoring server logs the computers 11A, 11B, 11C, and 12 into the network 15. If the user name or password is incorrect and the authentication result is impossible, the monitoring server 13 prohibits the login of the computers 11A, 11B, 11C, and 12 to the network 15 and displays a login failure message as the computers 11A, 11B, and 11C. , 12 are displayed on the displays 16 and 17. In this system 10, the monitoring server 13 authenticates the computers 11A, 11B, 11C, and 12 when the business computers 11A, 11B, and 11C and the management computer 12 are started up. , 11B, 11C, and 12 cannot be logged into the network 15, so that unauthorized entry into the network 15 due to falsification of authentication information or diversion of authentication information can be prevented.

3 and 4 are diagrams showing examples of start / end operation histories, use operation histories within the operation permission time, and use operation histories of permitted applications, and show weekly use histories of the business computers 11A, 11B, and 11C. . 3 and 4, the display of specific names and numerical values of each item is omitted. The monitoring server 13 monitors the activation and termination of the business computers 11A, 11B, and 11C within the operation permission time in time series. The monitoring server 13 determines whether the use of the business computers 11A, 11B, and 11C is within the operation permission time or outside the operation permission time by the timer function, and when the computers 11A, 11B, and 11C are activated within the operation permission time, Judged to be used within the operation permission time. When the business computer 11A, 11B, 11C is turned on within the operation permission time, the monitoring server 13 identifies the computer 11A, 11B, 11C identification number (computer name, IP address, MAC address, etc.), the computer The activation date / time of 11A, 11B, 11C is stored in the hard disk (activation operation history acquisition means). When the computers 11A, 11B, and 11C are turned off, the identification numbers (computer names, IP addresses, MAC addresses, etc.) of the computers 11A, 11B, and 11C, and the end dates and times of the computers 11A, 11B, and 11C are stored on the hard disk. (End operation history acquisition means).

The monitoring server 13 monitors the usage operation status of the business computers 11A, 11B, and 11C logged into the network 15 and the usage operation status of the permitted application in time series. When the business computers 11A, 11B, and 11C are used, the use operation history is output from the computers 11A, 11B, and 11C to the monitoring server 13. When the installed application is activated and the business computers 11A, 11B, and 11C use the application, use operation history of the application is output from the computers 11A, 11B, and 11C to the monitoring server 13. The monitoring server 13 acquires the usage operation history and the usage operation history of the application output from the computers 11A, 11B, and 11C in time series, and stores the acquired usage operation history in the hard disk (operation history acquisition unit). When there is a request to output these histories from the management computer 12, the monitoring server 13 displays the start / end operation history and use operation history stored in the hard disk on the display 17 of the management computer 12, and these histories are displayed on the management computer 12. 12 is output from the printer 19 connected to 12 (operation history output means). The monitoring server 13 can divide and output each history into a predetermined period such as daily, weekly, or monthly.

When the operation history display within the operation permission time is selected from the report items on the report display screen (not shown) displayed on the display 17 of the management computer 12 and the period is specified, the operation permission is shown as shown in FIG. Each operation history data in a specified period of time is displayed on the display 17. FIG. 3 shows the use operation history data within the operation permitted time, the period specified in the period display area, the computer name in the computer name display area, the MAC address in the MAC address display area, the work address in the work group / domain display area. In the group / domain, the initial startup time is displayed in the initial startup time display area, the final end time is displayed in the final end time display area, and the number of operations of the business computers 11A, 11B, and 11C is displayed in the operation count display area.

3. When the computer name displayed in the underlined portion on the screen of FIG. 3 is selected, the details of the use operation history within the operation permission time of the selected computer are displayed on the display 17 as shown in FIG. FIG. 4 shows the details of the operation history within the operation permission time as operation month / day in the month / day display area, business computer name in the computer name display area, work group / domain / IP address display in the work group / domain display area. The IP address is displayed in the area, and the MAC address is displayed in the MAC address display area. In addition, the power ON / OFF display area has a power ON / OFF record, the user name display area has a user name (the name of an employee who manages the business computers 11A, 11B, and 11C), and the start date / time display area has a start date / time (application use start) Date / time), end date / time in the end date / time display area (application use end date / time), operation time in the operation time display area (application usage time), application name (used application name), operation window name in the application name display area The operation window name (the operation window name of the application used) is displayed in the area. The manager in charge can output the use operation history shown in FIGS.

In this system 10, since the monitoring server 13 collects the start / end operation histories of the business computers 11A, 11B, and 11C in time series, the manager in charge uses the monitoring server 13 in the computers 11A, 11B, and 11C. The startup / end status and the login status to the network 15 can be grasped, and the login status to the network 15 of each computer 11A, 11B, 11C can be monitored. In this system 10, since the monitoring server 13 collects the use operation history and the use operation history of the application within the operation permission time of the business computers 11A, 11B, and 11C in time series, the manager in charge uses the monitoring server 13. Thus, it is possible to grasp the usage status within the operation permission time and the usage status of the application in each of the business computers 11A, 11B, 11C, and monitor the use within the operation permission time and the use of the application of the computers 11A, 11B, 11C. As well as restricting unlimited use of the application.

FIGS. 5 and 6 are diagrams showing examples of the use operation history outside the operation permission time and the use operation history outside the operation permission time of the permitted application, and show the weekly use history of the business computers 11A, 11B, and 11C. In FIGS. 5 and 6, the display of specific names and numerical values of each item is omitted. The monitoring server 13 monitors the usage operation status of the business computers 11A, 11B, and 11C logged into the network 15 outside the operation permission time and the use operation status outside the operation permission time of the permitted application in time series. The monitoring server 13 determines whether the use of the business computers 11A, 11B, and 11C is within the operation permission time or outside the operation permission time by the timer function, and the computers 11A, 11B, and 11C are activated after the operation permission time has elapsed. Then, it is determined that it is used outside the operation permission time. When the business computer 11A, 11B, 11C is turned on outside the operation permission time, the monitoring server 13 identifies the computer 11A, 11B, 11C identification number (computer name, IP address, MAC address, etc.), the computer The start date and time of 11A, 11B, and 11C are stored in the hard disk. The authentication procedure when the computers 11A, 11B, and 11C log in to the network 15 is the same as that when the computers 11A, 11B, and 11C are activated within the operation permission time.

When the business computers 11A, 11B, and 11C are used outside the operation permission time, the use operation history is output from the computers 11A, 11B, and 11C to the monitoring server 13. When the installed application is activated and the business computers 11A, 11B, and 11C use the application outside the operation permission time, the use operation history of the application is output from the computers 11A, 11B, and 11C to the monitoring server 13. The The monitoring server 13 acquires the usage operation history outside the operation permission time and the usage operation history of the application output from the computers 11A, 11B, and 11C in time series, and stores the acquired usage operation history in the hard disk (operation History acquisition means). When there is a request to output these histories from the management computer 12, the monitoring server 13 displays the use operation history stored outside the operation permission time stored in the hard disk on the display 17 of the management computer 12, and these histories are displayed on the management computer 12. Is output from the printer 19 connected to the (operation history output means). The monitoring server 13 can divide and output each history into a predetermined period such as daily, weekly, or monthly.

When the operation history display outside the operation permission time is selected from the report items on the report display screen (not shown) displayed on the display 17 of the management computer 13 and the period is designated, as shown in FIG. Each operation history data in a specified period outside the time is displayed on the display 17. FIG. 5 shows the operation history data outside the operation permission time, the period specified in the period display area, the computer name in the computer name display area, the MAC address in the MAC address display area, the work address in the work group / domain display area. The user name is displayed in the group / domain, user name display area, and the usage count is displayed in the usage count display area.

When the computer name displayed in the underlined portion on the screen of FIG. 5 is selected, as shown in FIG. 6, details of the use operation history outside the operation permission time of the selected computers 11A, 11B, and 11C are displayed on the display 17. . FIG. 6 shows the operation history outside the operation permission time as the operation date in the month / day display area, the computer name in the computer name display area, and the work group / domain / IP address in the work group / domain display area. The IP address is displayed in the area, and the MAC address is displayed in the MAC address display area. Furthermore, the user name (employee name managing the computers 11A, 11B, and 11C) is displayed in the user name display area, the start date and time (application use start date and time) in the start date and time display area, and the end date and time (application date and time in the end date and time display area). End date / time), operation time in the operation time display area (application usage time), application name in the application name display area (application name used), operation window name in the operation window name display area (operation window name of the application used) ) Is displayed. The manager in charge can output the use operation history shown in FIGS.

In this system 10, since the monitoring server 13 collects the use operation history and the use operation history of the application outside the operation permission time of the business computers 11A, 11B, and 11C in time series, the manager in charge uses the monitoring server 13. Thus, it is possible to grasp the usage status outside the operation permission time and the usage status of the application in each of the business computers 11A, 11B, and 11C, and monitor the usage outside the operation permission time and the use of the application of the computers 11A, 11B, and 11C. In addition, the use of the computers 11A, 11B, and 11C outside the operation permission time can be restricted.

FIGS. 7 and 8 are diagrams showing examples of use operation histories of the computers 11A, 11B, and 11C in an external environment other than the network 15, and show weekly external use histories of the business computers 11A, 11B, and 11C. In FIGS. 7 and 8, the display of specific names and numerical values of each item is omitted. The monitoring server 13 monitors the usage operation status in the external environment other than the network 15 of the business computers 11A, 11B, and 11C and the usage operation status of the permitted application in time series. The business computers 11A, 11B, and 11C output identification numbers (computer names, IP addresses, MAC addresses, etc.) that identify them to the monitoring server 13 at regular time intervals (3-minute intervals, 5-minute intervals, etc.). The monitoring server 13 determines that the computers 11A, 11B, and 11C have left the network 15 when the identification numbers output from the computers 11A, 11B, and 11C at an equal interval are interrupted even once, and the computers 11A, 11B, and 11C When the identification number is output again at a predetermined time interval from 11C, it is determined that the computers 11A, 11B, and 11C are connected to the network 15 again, and it is determined that the computers 11A, 11B, and 11C are used in the external environment. .

When the monitoring server 13 determines that the computers 11A, 11B, and 11C are used in the external environment, the identification number (computer name, IP address, MAC address, etc.) of the computers 11A, 11B, and 11C, and the computers 11A, 11B, and 11C Store the date and time of use in the external environment on the hard disk. The authentication procedure when the computers 11A, 11B, and 11C log in to the network 15 is the same as that when the computers 11A, 11B, and 11C are activated within the operation permission time.

When the business computers 11A, 11B, and 11C are used in the external environment, the use operation history is output from the computers 11A, 11B, and 11C to the monitoring server 13. When the installed application is activated and the business computers 11A, 11B, and 11C use the application in the external environment, the use operation history of the application is output from the computers 11A, 11B, and 11C to the monitoring server 13. The monitoring server 13 acquires the usage operation history in the external environment and the usage operation history of the application output from the computers 11A, 11B, and 11C in time series, and stores the acquired usage operation history in the hard disk (operation history acquisition). means). When there is a request to output the history from the management computer 12, the monitoring server 13 displays the use operation history in the external environment stored in the hard disk on the display 17 of the management computer 12 and connects the history to the management computer 12. Output from the printer 19 (operation history output means). The monitoring server 13 can divide and output each history into a predetermined period such as daily, weekly, or monthly.

When an external operation history display is selected from a report item on a report display screen (not shown) displayed on the display 17 of the management computer 12 and a period is specified, as shown in FIG. Each operation history data for the period is displayed on the display 17. FIG. 7 shows the operation history data of the external environment as a period specified in the period display area, the computer name in the computer name display area, the MAC address in the MAC address display area, and the work group / domain display area in the work group / domain display area. The user name (employee name managing the computers 11A, 11B, and 11C used in the external environment) is displayed in the domain / user name display area, and the use count in the external environment is displayed in the use count display area.

When the computer name displayed in the underlined portion in the screen of FIG. 7 is selected, the details of the usage operation history in the external environment of the selected computers 11A, 11B, and 11C are displayed on the display 17, as shown in FIG. FIG. 7 shows the details of the operation history in the external environment as the operation date in the month / day display area, the computer name in the computer name display area, the work group / domain in the work group / domain display area, and the IP address display area. The MAC address is displayed in the IP address / MAC address display area. Furthermore, the external use start time is displayed in the external use start time display area, the external use end time is displayed in the external use end time display area, the user name is displayed in the user name display area, the application use start time is displayed in the application use start time display area, and the application use end time is displayed. Application use end time in the display area, application operation time in the application operation display area, application name in the application name display area (application name used for external use), operation window name in the operation window name display area (external use) The name of the operation window of the application used at the time is displayed. The manager in charge can output the use operation history shown in FIGS.

In this system 10, since the monitoring server 13 collects the use operation history and the use operation history of the application in the external environment other than the network 15 of the business computers 11A, 11B, and 11C in time series, the manager of the management uses the monitoring server 13. It is possible to grasp the external usage status and application usage status of each of the business computers 11A, 11B, and 11C, and specify the computers 11A, 11B, and 11C used in the external environment. The system 10 can monitor the use of the computers 11A, 11B, and 11C in the external environment and the use of applications, and can regulate the use of the computers 11A, 11B, and 11C in the external environment. Unauthorized actions such as unauthorized removal of data, alteration of data, and destruction of data can be regulated.

FIG. 9 is a diagram showing an example of an application installation operation history, and FIG. 10 is a diagram showing the contents of the installed application. In FIGS. 9 and 10, the display of specific names, numerical values, and the like of each item is omitted. The monitoring server 13 monitors application installation on the business computers 11A, 11B, and 11C in time series. When various applications are installed in the business computers 11A, 11B, and 11C, the monitoring server 13 acquires the installation history from the computers 11A, 11B, and 11C, and stores the acquired installation history in the hard disk (installation history acquisition unit) ). When the monitoring server 13 receives an installation history output request from the management computer 12, the monitoring server 13 displays the installation history stored in the hard disk on the display 17 of the management computer 12, and the installation history is displayed on the printer 19 connected to the management computer 12. (Installation history output means). The monitoring server 13 can output the installation history by dividing it into a predetermined period such as daily, weekly, or monthly.

When the installation history display is selected from the report items on the report display screen (not shown) displayed on the display 17 of the management computer 12 and the period is specified, as shown in FIG. 9, the business computers 11A, 11B, The installation history data of the application in 11C is displayed on the display 17. In FIG. 9, a computer name (computer name on which an application is installed) is displayed in the computer name display area, a date (installation date and time) is displayed in the date display area, and an application name (installed application name) is displayed in the application name display area.

The management computer 12 can request the monitoring server 13 to output the contents of the application installed in the computers 11A, 11B, and 11C. When there is an output request for the contents of the installed application, the monitoring server 13 displays the contents of the application on the display 17 of the management computer 12 and outputs the contents of the application from the printer 17 connected to the computer 12. (Installed application content output means). When the application name is highlighted on the screen of FIG. 9 and the content display is clicked, the contents of the installed application are displayed in the application content display area together with the computer name and application name, as shown in FIG. The contents of the application are an outline of applications such as document creation software, spreadsheet software, translation software, database construction software, communication software, and security software. In this system 10, since the person in charge of management can grasp the installation status of applications in the computers 11 </ b> A, 11 </ b> B, and 11 </ b> C using the monitoring server 13, it is possible to regulate unnecessary application installation actions by employees.

FIG. 11 is a diagram showing an example of an application uninstall operation history, and FIG. 12 is a diagram showing the contents of the uninstalled application. In FIGS. 11 and 12, the display of specific names and numerical values of each item is omitted. The monitoring server 13 monitors the uninstall of applications from the business computers 11A, 11B, and 11C in time series. When various applications are uninstalled from the business computers 11A, 11B, and 11C, the monitoring server 13 acquires the uninstall history from the computers 11A, 11B, and 11C, and stores the acquired uninstall history in the hard disk (uninstallation). Installation history acquisition means). When there is a request to output the uninstall history from the management computer 12, the monitoring server 13 displays the uninstall history stored in the hard disk on the display 17 of the management computer 12, and the uninstall history is connected to the management computer 12. Output from the printer 19 (uninstallation history output means). The monitoring server 13 can output the uninstallation history in a predetermined period such as daily, weekly, or monthly.

When the uninstall history display is selected from the report items on the report display screen (not shown) displayed on the display 17 of the management computer 12 and the period is specified, as shown in FIG. 11, the business computers 11A and 11B , 11C, the application uninstall history data is displayed on the display 17. In FIG. 11, the computer name (computer name from which the application was uninstalled) is displayed in the computer name display area, the date (uninstallation date / time) is displayed in the date display area, and the application name (uninstalled application name) is displayed in the application name display area. ing.

The management computer 12 can request the monitoring server 13 to output the contents of the application uninstalled from the computers 11A, 11B, and 11C. When there is a request to output the contents of the uninstalled application, the monitoring server 13 displays the contents of the application on the display 17 of the management computer 12 and outputs the contents of the application from the printer 17 connected to the computer 12. (Uninstall application contents output means) When the application name is highlighted and the content display is clicked on the screen of FIG. 11, the contents of the uninstalled application are displayed in the application content display area together with the computer name and application name, as shown in FIG. The contents of the application are an outline of applications such as document creation software, spreadsheet software, translation software, database construction software, communication software, and security software. In this system 10, since the person in charge of management can grasp the uninstallation status of applications in the computers 11 </ b> A, 11 </ b> B, and 11 </ b> C using the monitoring server 13, it is possible to restrict unauthorized uninstallation of applications by employees. it can.

13 and 14 are diagrams showing an example of the printing operation history, and show the weekly printing operation history of the computers 11A, 11B, and 11C. In FIGS. 13 and 14, the display of specific names and numerical values of each item is omitted. The monitoring server 13 monitors the printing operation status of the business computers 11A, 11B, and 11C logged into the network 15 in time series. When the computer 11A, 11B, or 11C prints predetermined data via the printer 18, the monitoring server 13 identifies the computer 11A, 11B, or 11C (computer name, IP address, MAC address, etc.), the computer 11A, The printing operation dates and times of 11B and 11C are stored in the hard disk.

When the business computers 11A, 11B, and 11C print predetermined data by the printer 18, the print operation history is output from the computers 11A, 11B, and 11C to the monitoring server 13. The monitoring server 13 acquires the print operation histories output from the computers 11A, 11B, and 11C in time series, and stores the acquired print operation histories in the hard disk (operation history acquisition unit). When there is a print operation history output request from the management computer 12, the monitoring server 13 displays the print operation history stored in the hard disk on the display 17 of the management computer 12, and the print operation history is connected to the management computer 12. Output from the printer 19 (operation history output means). The monitoring server 13 can divide and output each printing operation history by a predetermined period such as daily, weekly, or monthly.

When printing operation history display is selected from the report items on the report display screen (not shown) displayed on the display 17 of the management computer 12 and a period is designated, as shown in FIG. 13, the printing operation for the designated period is performed. History data is displayed on the display 17. FIG. 13 shows, as print operation history data, the period specified in the period display area, the computer name for business (the name of the computer that performed the print operation) in the computer name display area, the MAC address in the MAC address display area, and the work group / domain. The work area / domain is displayed in the display area, the user name is displayed in the user name display area (the name of the employee who manages the computers 11A, 11B, and 11C that performed the printing operation), the total number of print pages is displayed in the print total page count display area, and the print count display area. Shows the number of prints.

When the computer name displayed in the underlined portion on the screen of FIG. 13 is selected, the details of the printing operation history of the selected computers 11A, 11B, and 11C are displayed on the display 17, as shown in FIG. FIG. 14 shows the details of the print operation history as the month and day of the print operation in the month and day display area, the computer name in the computer name display area, the workgroup / domain in the workgroup / domain display area, and the IP address display area. The MAC address is displayed in the IP address / MAC address display area. Further, the employee name is displayed in the user name display area, the print date and time in the print date display area, the document name in the document name display area, the number of print pages in the print page number display area, and the printer name in the printer name display area. The manager in charge can output the usage history shown in FIGS.

In this system 10, since the monitoring server 13 collects the printing operation histories in the computers 11A, 11B, and 11C in time series, the manager in charge uses the monitoring server 13 to perform the printing operations in the business computers 11A, 11B, and 11C. The situation can be grasped. Since this system 10 can monitor printing operations in the computers 11A, 11B, and 11C and can regulate unlimited printing operations in the computers 11A, 11B, and 11C, it can restrict unauthorized printing of data by employees. Can do.

15 and 16 are diagrams showing an example of the file access history, and show the weekly file access history of the business computers 11A, 11B, and 11C. In FIGS. 15 and 16, the display of specific names and numerical values of each item is omitted. The monitoring server 13 monitors the file access status of the business computers 11A, 11B, and 11C logged into the network 15 in time series. When the computer 11A, 11B, or 11C accesses a predetermined file, the monitoring server 13 identifies the computer 11A, 11B, or 11C identification number (computer name, IP address, MAC address, etc.), and the computer 11A, 11B, or 11C file. Store the access date and time on the hard disk.

When the business computers 11A, 11B, and 11C access a predetermined file, the file access history is output from the computers 11A, 11B, and 11C to the monitoring server 13. The monitoring server 13 acquires the file access history output from the computers 11A, 11B, and 11C in time series, and stores the acquired file access history in the hard disk (operation history acquisition means). When there is a file access history output request from the management computer 12, the monitoring server 13 displays the file access history stored in the hard disk on the display 17 of the management computer 12, and the file access history is connected to the management computer 12. Output from the printer 19 (operation history output means). The monitoring server 13 can divide and output each file access history by a predetermined period such as daily, weekly, or monthly.

When file access history display is selected from the report items on the report display screen (not shown) displayed on the display 17 of the management computer 12 and a period is designated, as shown in FIG. 15, file access for the designated period is performed. History data is displayed on the display 17. FIG. 15 shows the file access history data as a period specified in the period display area, the computer name display area for the business computer (the name of the computer that performed the file access), the MAC address display area for the MAC address, and the workgroup / domain. The work area / domain is displayed in the display area, the user name (the name of the employee who manages the computers 11A, 11B, and 11C that performed file access) is displayed in the user name display area, and the access count is displayed in the access count display area.

15 is selected, the details of the file access history of the selected computers 11A, 11B, and 11C are displayed on the display 17, as shown in FIG. In FIG. 16, as the details of the file access history, the date of file access is displayed in the month / day display area, the computer name is displayed in the computer name display area, the work group / domain is displayed in the work group / domain display area, and the IP address display area is displayed. The MAC address is displayed in the IP address / MAC address display area. Furthermore, the employee name in the user name display area, the access date and time in the access date and time display area, the operation content in the operation content display area (copy, cut, write, delete, create holder, rename, etc.), and the file name in the file name display area The file name before change is displayed in the file name display area before change. The person in charge of management can output the file access history shown in FIGS.

In this system 10, since the monitoring server 13 collects file access histories in the computers 11A, 11B, and 11C in time series, the person in charge of management uses the monitoring server 13 to access the files of the business computers 11A, 11B, and 11C. The situation can be grasped. Since the system 10 can monitor the access status of files in the computers 11A, 11B, and 11C and can regulate unlimited use of files, it can regulate unauthorized use of files by employees.

FIGS. 17 and 18 are diagrams showing an example of the printing action history, showing the weekly printing action history of the business computers 11A, 11B, and 11C. In FIGS. 17 and 18, the display of specific names and numerical values of each item is omitted. The monitoring server 13 monitors in time series the printing actions in the computers that are prohibited from printing among the business computers 11A, 11B, and 11C. When the computers 11A, 11B, and 11C, which are prohibited from printing, attempt to print predetermined data, the monitoring server 13 identifies the computers 11A, 11B, and 11C (computer name, IP address, MAC address, etc.), computer The printing action dates of 11A, 11B, and 11C are stored in the hard disk. In addition to the method of prohibiting data printing on a computer by specifying a computer, the method of prohibiting data printing on a specific computer can also be used to specify the drive installed in the computer and print the data stored in that drive. There is a way to ban.

When a printing action is performed on the computers 11A, 11B, and 11C, which are prohibited from printing, or when a printing action is performed on the print-prohibited drive, the monitoring server 13 stores the printing action history in the computers 11A, 11B, and 11C. To the monitoring server 13. The monitoring server 13 acquires the printing action histories output from the computers 11A, 11B, and 11C in time series, and stores the acquired printing action histories in the hard disk (operation history acquisition unit). When there is a print action history output request from the management computer 12, the monitoring server displays the print action history stored in the hard disk on the display 17 of the management computer 12, and the print action history is connected to the management computer 12. Output from the printer 19 (operation history output means). The monitoring server 13 can divide and output each printing activity history by a predetermined period such as daily, weekly, monthly or the like.

When the printing action history is selected from the report items on the report display screen (not shown) displayed on the display 17 of the management computer 12 and the period is designated, as shown in FIG. 17, the printing action history for the designated period is displayed. Data is displayed on the display 17. FIG. 17 shows the print activity history data as a period specified in the period display area, the computer name (computer name on which the printing act was performed) in the computer name display area, the work group / domain, user in the work group / domain display area. The name display area displays the user name (the name of the employee who manages the computers 11A, 11B, and 11C that performed the printing action), and the printing action count display area displays the printing action count.

When the computer name displayed in the underlined portion on the screen of FIG. 17 is selected, the details of the printing activity history of the selected computers 11A, 11B, and 11C are displayed on the display 17, as shown in FIG. In FIG. 18, as the details of the printing activity history, the month and date of the printing activity in the month / day display area, the computer name in the computer name display area, the work group / domain in the work group / domain display area, and the IP address display area The MAC address is displayed in the IP address / MAC address display area. Furthermore, the employee name in the user name display area, the date and time of printing in the printing action date and time display area, the document name (name of the document to be printed) in the document name display area, and the printer name (the printing action was performed in the printer name display area) Printer name) is displayed. The manager in charge can output the printing action history shown in FIGS.

In this system 10, the monitoring server 13 collects the printing activity histories in the computers 11 </ b> A, 11 </ b> B, and 11 </ b> C in time series, and each business computer 11 </ b> A, 11 </ b> B for which the manager responsible uses the monitoring server 13 to prohibit the printing activity. , 11C printing action status can be grasped. This system 10 can monitor the status of printing actions on computers 11A, 11B, and 11C where printing actions are prohibited, and regulates illegal actions such as unauthorized removal of data, falsification of data, and destruction of data. Can do.

19 and 20 are diagrams illustrating an example of a take-out action history, and show weekly take-out action histories of the business computers 11A, 11B, and 11C. In FIGS. 19 and 20, the display of specific names and numerical values of each item is omitted. The monitoring server 13 monitors in time series the take-out action in the computer for which data take-out is prohibited among the business computers 11A, 11B, and 11C. The monitoring server 13 identifies the computer 11A, 11B, 11C identification number (computer name, IP address, MAC address, etc.) when the computer 11A, 11B, 11C is prohibited from taking out data. The date and time when the computers 11A, 11B, and 11C are taken out is stored in the hard disk. In addition to a method for prohibiting data export from a specified computer, a method for prohibiting data export in a specific computer is a method for prohibiting copying of data stored in a drive mounted on the computer (drive Prohibiting copying to the drive mounted on the computer.

The monitoring server 13 takes out data stored in the computers 11A, 11B, and 11C that are prohibited from taking out data (data search, data copy, data cut, data paste, data write in the computers 11A, 11B, and 11C). ), When a copy action is performed on a copy-prohibited drive, or when a write action is performed on a write-protected drive, the carry-out action history is output from the computers 11A, 11B, and 11C to the monitoring server 13. . The monitoring server 13 acquires the take-out action history output from the computers 11A, 11B, and 11C in time series, and stores the acquired take-out action history in the hard disk (operation history acquisition means). When there is a request to output a take-out action history from the management computer 12, the monitoring server 13 displays the take-out action history stored in the hard disk on the display 17 of the management computer 12, and the take-out action history is connected to the management computer 12. Output from the printer 19 (operation history output means). The monitoring server 13 can output each take-out action history in a predetermined period such as daily, weekly, or monthly.

When a take-out action history is selected from a report item on a report display screen (not shown) displayed on the display 17 of the management computer 12 and a period is designated, as shown in FIG. 19, a take-out action history for the designated period is shown. Data is displayed on the display 17. FIG. 19 shows, as a take-out action history, a computer name (computer name where the take-out action was performed) in the computer name display area, a work group / domain, and a user name in the work group / domain display area for the period specified in the period display area. The display area displays the user name (the name of the employee who manages the computers 11A, 11B, and 11C where the take-out action was performed), and the take-out action count display area.

When the computer name displayed in the underlined portion in the screen of FIG. 19 is selected, the details of the carry-out action history of the selected computers 11A, 11B, and 11C are displayed on the display 17, as shown in FIG. FIG. 20 shows the details of the take-out action history as the date of the take-out action in the month / day display area, the computer name in the computer name display area, the work group / domain in the work group / domain display area, and the work group / domain in the IP address display area. The MAC address is displayed in the IP address / MAC address display area. In addition, the employee name in the user name display area, the date and time of the take-out action in the display area of the take-out action, the contents of the take-out operation in the display area of the take-out operation (data search, copy, cut, paste, write, etc.), and take out in the file name display area The file name where the action was performed and the file name before the change (the file name before being changed by the take-out action) are displayed in the file name display area before the change. The manager in charge can output the carry-out action history shown in FIGS.

In this system 10, since the monitoring server 13 collects the carry-out action history in the computers 11 </ b> A, 11 </ b> B, 11 </ b> C in time series, each business computer 11 </ b> A, 11B and 11C can be grasped. The system 10 can monitor the status of the computer 11A, 11B, 11C where the act of taking out is prohibited, and regulates illegal acts such as unauthorized data take-out, data tampering, and data destruction by employees. Can do.

FIGS. 21 and 22 are diagrams showing an example of the access history of the prohibited application, and show weekly access histories of the business computers 11A, 11B, and 11C. In FIGS. 21 and 22, the display of specific names, numerical values, and the like of each item is omitted. The monitoring server 13 monitors the act of accessing the operation prohibited application of the business computers 11A, 11B, and 11C logged into the network 15 in time series. The movement prohibition application is stored in the hard disk of the monitoring server 13 in a state of being divided for each business computer 11A, 11B, 11C. When the business computers 11A, 11B, and 11C access the prohibited application, the monitoring server 13 identifies the computers 11A, 11B, and 11C (computer names, IP addresses, MAC addresses, etc.), computers 11A, 11B, and 11C. The access act date and time is stored on the hard disk.

When the business computers 11A, 11B, and 11C try to start a predetermined application, the monitoring server 13 determines whether the application corresponds to a movable prohibited application stored in the hard disk. When the monitoring server 13 determines that the application falls under the prohibition of movement, the monitoring server 13 acquires the access history of the movement prohibition application in the computers 11A, 11B, and 11C in time series, and stores the acquired access history in the hard disk (operation history). Acquisition means). When there is a request to output the access history of the prohibited application from the management computer 12, the monitoring server 13 displays the access history stored in the hard disk on the display 17 of the management computer 12 and connects the access history to the management computer 12. Output from the printer 17 (operation history output means). The monitoring server 13 can output each access history in a predetermined period such as daily, weekly, or monthly.

When an access history is selected from a report item on a report display screen (not shown) displayed on the display 17 of the management computer 12 and a period is designated, as shown in FIG. 21, access history data for the designated period is obtained. It is displayed on the display 17. In FIG. 21, as the access history, the computer name (the computer name that accessed the immobile application) is displayed in the computer name display area, the work group / domain, and the user name are displayed in the work group / domain display area. The user name (name of the employee who manages the computers 11A, 11B, and 11C that accessed the prohibited application) is displayed in the area, and the number of accesses (number of accesses to the prohibited application) is displayed in the access count display area.

21. When the computer name displayed in the underlined portion on the screen of FIG. 21 is selected, the details of the access history of the selected computers 11A, 11B, and 11C are displayed on the display as shown in FIG. FIG. 22 shows the details of the access history, the date of access in the month / day display area, the name of the business computer in the computer name display area, the workgroup / domain in the workgroup / domain display area, and the IP address in the IP address display area. The MAC address is displayed in the MAC address display area 61. Furthermore, the employee name is displayed in the user name display area, the access date and time (access date and time to the immobilized application) is displayed in the access date and time display area, and the application name (accessed improper application name) is displayed in the application name display area. The manager in charge can output the access history shown in FIGS.

In this system 10, since the monitoring server 13 collects access history of the business computers 11 </ b> A, 11 </ b> B, and 11 </ b> C to the prohibited applications, the manager in charge uses the monitoring server 13 to computer 11 </ b> A, 11 </ b> B, 11 </ b> C. It is possible to grasp the access status to the movable prohibited application. The system 10 can monitor the access status of the movable prohibited application in the computers 11A, 11B, and 11C, and can suppress an access action to the application.

In the device management system 10, a user level operation history acquisition application that causes the monitoring server 13 to acquire a user level operation history when the business computers 11A, 11B, and 11C execute operations that can be executed at the user level is the business computer 11A, Since it is registered in the invisible startup registry in 11B and 11C, the activation check box of the operation history acquisition application cannot be unchecked, and the user level operation history acquisition application is activated when each business computer 11A, 11B, and 11C is activated. Cannot be disabled. Therefore, the monitoring server 13 can reliably acquire an operation history of operations that can be executed at the user level from each of the business computers 11A, 11B, and 11C. In this system 10, when each business computer 11 A, 11 B, 11 C executes an operation that can be performed at the user level, the operation history is centrally managed by the monitoring server 13, and each business computer 11 A, 11 B, Since the user-level operation history of 11C can be collated and monitored, it is possible to reliably prevent unauthorized actions such as data falsification and data destruction by employees.

The device management system 10 has a system level operation history acquisition application for causing the monitoring server 13 to acquire a system level operation history when the business computers 11A, 11B, and 11C execute operations that can be executed at the system level. Since it is registered in the task that is difficult to see in 11B and 11C, it is difficult to uncheck the activation check box of the operation history acquisition application, and the system level operation history acquisition application is activated when each business computer 11A, 11B, and 11C is activated. Cannot be disabled. Therefore, the monitoring server 13 can reliably acquire an operation history of operations that can be executed at the system level from each of the business computers 11A, 11B, and 11C. In this system 10, when each business computer 11 A, 11 B, 11 C executes an operation that can be executed at the system level, the operation history is centrally managed by the monitoring server 13, and each business computer 11 A, 11 B, 11 Since the system level operation history of 11C can be collated and monitored, it is possible to reliably prevent unauthorized actions such as data falsification and data destruction by employees.

DESCRIPTION OF SYMBOLS 10 Device management system 11A Business computer 11B Business computer 11C Business computer 12 Management computer 13 Device monitoring server 14 Hub 16 Display 17 Display 18 Printer 19 Printer

Claims (6)

1. In a device management system comprising a plurality of terminal devices used by a user and a monitoring server connected to a network formed from these terminal devices and monitoring these terminal devices in time series,
   The terminal device is installed with a user level operation history acquisition application that causes the monitoring server to acquire a user level operation history when the terminal device executes an operation that can be executed at the user level. Is registered in an invisible startup registry in the terminal device.
2. The terminal device is installed with a system level operation history acquisition application that causes the monitoring server to acquire a system level operation history when the terminal device executes an operation that can be executed at the system level, and the system level operation history acquisition application Is registered in a task that is difficult to see in the terminal device.
3. The operations that can be performed at the user level include use operations within the operation permission time of the terminal devices in the network, use operations outside the operation permission time of the terminal devices in the network, and those in an external environment other than the network. And the user level operation history is a use operation history within the operation permission time of the terminal devices in the network, a use operation history outside the operation permission time of the terminal devices in the network, and The device management system according to claim 1 or 2, which is a use operation history of those terminal devices in an external environment other than the network.
4. The operations that can be executed at the user level are the use operation of the permitted applications of the terminal devices, the installation operation of the various applications of the terminal devices, and the uninstall operation of the various applications of the terminal devices. The history is a usage operation history of permitted applications of the terminal devices, an installation operation history of various applications of the terminal devices, and an uninstall operation history of various applications of the terminal devices. The device management system described in 1.
5. Operations that can be executed at the system level are start / end operations of the terminal devices, printing operations at the terminal devices, and access operations to files used at the terminal devices, and the system level operation history is: The device management system according to any one of claims 2 to 4, which is a start / end operation history of the terminal devices, a print operation history of the terminal devices, and an access operation history of a file used in the terminal devices. .
6. The system level operation history includes a print operation history in a terminal device in which data printing is prohibited among the terminal devices, a data take-out operation history in a terminal device in which data take-out is prohibited, and the terminals. The device management system according to claim 2, wherein the device operation system is a start operation history of a movable prohibition application in the apparatus.
   

Images