[Alona Kutsenko]

The task: chiefs of the departments need permission to launch Ultra VNC plugin (v.1.6 and higher) for remote screen viewing of employees' computers, but only in specified departments. You can't use a mouse and keyboard. The script must also send corresponding notifications about the impossibility to start the session of the remote screen sharing if a user is not allowed to.

These restrictions must not affect network administrators.

You can do all of this by the following script:

vnc-script.png (86.63 KiB) Viewed 6292 times

Code: Select all

// ---------------------------------------
// Script created by Alexey Pikurov / Network Software Solutions
// 28.11.2016 16:58:47
// ---------------------------------------
const
  sAdmGroup = 'Administrators';
  sErrMsg1  = 'You do not have access to this user';
  sErrMsg2  = 'You can only view the screen of this user';
  
function OnClientPluginSendRawData(iCID, iUINFrom, iUINTo: integer; sPluginNameFrom, sPluginNameTo, sData: string): boolean;
var
  bFlag: boolean;
  iDeptID1, iDeptID2: integer;
  sMsg: string;
begin
  bFlag := true;

    // if a user opens VNCClient plugin 
    if (sPluginNameFrom = 'VNCClient') and (sPluginNameTo = 'VNCServer') then 
      // If this is not a user from the group "Administrators"
      if mGetRoleNameByID(mGetUserRoleID(iUINFrom)) <> sAdmGroup then begin
        // If a user is going to only view the remote screen
        if sData = 'VNCGETLOCALIPS-VIEW' then begin
          bFlag := false;   
      
          iDeptID1 := mGetUserDepartmentID(iUINFrom);
          iDeptID2 := mGetUserDepartmentID(iUINTo);

            // if users from the same department 
            // and iUINFrom - is a chief of this department
            if iDeptID1 = iDeptID2 then bFlag := mIsUserTeamLead(iUINFrom);
            
            if not bFlag then sMsg := sErrMsg1;
        end else 
        // if a user is going to take control over a mouse and keyboard,
        // then forbid him to opent the VNC session
        if sData = 'VNCGETLOCALIPS-CONTROL' then begin
          sMsg := sErrMsg2;
          bFlag := false;
        end;  
      
        if not bFlag then 
          // send a message about impossibility
          // to open a session of remote administration
          mSendCustomMsgToClientConsoleByCID(iCID, 
                                             sMsg + 
                                             ' (' + mGetUserAttribute(iUINTo, 'DisplayName') + ')',
                                             'Error', true, true, 77);
      end;  
  
  result := bFlag;
end;

begin

end.

The script supposes, that your administrators are in the group "Administrators". If not — edit the constant sAdmGroup.

Also, you should assign work positions in their profiles:

workpositions.png (35.6 KiB) Viewed 6292 times

...and do not forget to specify that they are heads of departments (additionally highlighted by blue color):

workpositions2.png (35.93 KiB) Viewed 6292 times

real human bean