How I Know the Domain Login & Local Login for each winXP as Admin

Dear All,

 Is there a way to know eash PC(Win XP) whats have the NT Domain Login & Local Login as Administrator
 Ex:
We have Win2000 Server SP.4 whith  1 Domain and 1500 XP PC in our company as Administrators i can know by IPaddres The name of Win Xp pc registerd like this IP (10.3.3.17 ----> Neno as PC)  but the main Q? the NeNo pc which Domain Login he used and if it possible if i can now also the Local Login he created on Neno PC.

Thanks
NemreenAsked:
Who is Participating?
 
Scott_WillcocksConnect With a Mentor Commented:
like I said log onto th the remote management goto event viewer of the PC and check the security tab this lists all the login attempts on that pc

you can right mouse click on the security tab and goto properties and set the event viewer to only log information you want. in this case successful audits also leave the failed on as if the user gets there logon attempt wrong it logs it there as well.

heres dos

@ECHO.
@ECHO The user logged in is: %USERNAME%
@ECHO.

put in a batch and >> to text

vbscript

Dim strUserName
Set wshShell = WScript.CreateObject("WScript.Shell")
strUserName = WshShell.ExpandEnvironmentStrings("%USERNAME%")
WScript.Echo ("The user logged in is: " & vbCrlf & strUserName


or better if w2k or xp WMI

Dim strUserName
Set WshNetwork = WScript.CreateObject("WScript.Network")
strUserName = WshNetwork.UserName
WScript.Echo ("The user logged in is: " & vbCrlf & strUserName

the last two you need to be logged on as the user if you have logon scripts you can change thw wscript.echo and get it to pass it to a text file then just set up a machine poilicy and attach the script to it.

0
 
NemreenAuthor Commented:
Still there no answer ? its clear
0
 
Scott_WillcocksCommented:
to find out what local account he used on his machine

right mouse click >my computer and select manage from your machine

 In the management console right mouse click computer management local and select connect to another computer
type in the network name formthe pc in question Neno this connect to his management console.

go to the local users and groups and check users to see iwhat locally held user accounts are on this machine delete the ones you don't want him to have.

Or rename if you like.

then goto groups and enter the administrator group and remove any usernames that you don't want to have local administrator rights on the local machine.

to go through the security log

goto the event viewer and if you are the domain admin goto the security tab this lists everyone who has logged onto that pc also any failed attempts browse through there and you should get an idea of whose logging onto the rogue PC
0
 
NemreenAuthor Commented:
Thanx Man now i can know for eash machine the local account.

 ok but how i know the domain login like Neno PC the user he logine by Nazx01@xxx.com.ca to the domain? (How I Know the Domain Login fo each PC )
0
 
NemreenAuthor Commented:
Ok Thans again its very clear :)
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.