Solved

How can we find which user is authenticating from which DC.

Posted on 2010-11-25
7
337 Views
Last Modified: 2012-05-10
Hi,

How can we find which user is authenticating from which DC.

i want to know say which server are 1 to 1000 people geting there authentication from. is it from 1 server or many Dc's.

Can anyone help me with a procedure or a script to extract this.

regards
Raja
0
Comment
Question by:bsharath
  • 3
  • 3
7 Comments
 
LVL 25

Expert Comment

by:Tony Johncock
ID: 34213348
One quick and dirty way is a simple login script:

In bat file format (yuck) it's quick and dirty:

@Echo off
Echo %USERNAME% %LOGONSERVER% >> \\server\share\auth.txt


 
0
 
LVL 11

Author Comment

by:bsharath
ID: 34213490
Thanks but will need a way to query all users ntlogins in the list or a way to query the domain itself and find all users who got authenticated with the date and time (last)
0
 
LVL 25

Accepted Solution

by:
Tony Johncock earned 334 total points
ID: 34213556
Ok I should be able to come up with something using WMI but in the meantime, you could

@Echo off
Echo %DATE% %TIME% %USERNAME% %LOGONSERVER% >> \\server\share\auth.txt

It'll give you what you need but needless to say isn't as flexible as being able to run a script to retrieve the info.

0
3 Use Cases for Connected Systems

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, testing some more, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us.

 
LVL 11

Author Comment

by:bsharath
ID: 34213634
thanks but to place this i have 100 approvals and a CR in middle. So an alternative would be helpful...
0
 
LVL 10

Assisted Solution

by:dhruvarajp
dhruvarajp earned 166 total points
ID: 34214363
you can use
set L
command on the workstation to get the logonservers.

create a script around it


0
 
LVL 25

Assisted Solution

by:Tony Johncock
Tony Johncock earned 334 total points
ID: 34216252
This is actually difficult - getting the last logon time is fairly easy but the authenticating server is not so easy(!).

Not sure it's going to be attainable by script.

However, there might be tools that can do it for free:

http://www.manageengine.com/products/free-windows-active-directory-tools/free-windows-active-directory-query-tool.html

http://maxpowersoft.com/adreportslite.php

VBScript to report user name & logon time (use cscript otherwise, you get a popup for every username in wscript - save it to a file, then cscript file.vbs from a command prompt):

intBias = TimeZoneBias
arrAttributes = Array("lastLogonTimeStamp","displayname","mail")
 
Set adoCommand = CreateObject("ADODB.Command")
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"
adoCommand.ActiveConnection = adoConnection
 
Set objRootDSE = GetObject("LDAP://RootDSE")
strBase = "<LDAP://" & objRootDSE.Get("defaultNamingContext") & ">"
Set objRootDSE = Nothing
 
strFilter = "(&(objectCategory=person)(objectClass=user))"
strAttributes = Join(arrAttributes,",")
Wscript.Echo Join(arrAttributes,";")
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
adoCommand.CommandText = strQuery
adoCommand.Properties("Page Size") = 100
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False
Set adoRecordset = adoCommand.Execute
Do Until adoRecordset.EOF
    On Error Resume Next
    strTempOutput = ""
    For i = 1 To Ubound(arrAttributes)
        strTempOutput =  strTempOutput & " ; " & adoRecordset.Fields(arrAttributes(i)).Value
        strOutput = Mid(Ltrim(strTempOutput),3)
    Next
    Set objDate = adoRecordset.Fields(arrAttributes(0)).Value
    If (Err.Number <> 0) Then
        dtmDate = #1/1/1601#
    Else
        dtmDate = ((((objDate.Highpart * (2^32)) + objDate.LowPart)/(600000000 - intBias))/1440) + #1/1/1601#
    End If
    Set objDate = Nothing
    Wscript.Echo strOutput & " ; " & dtmDate
    adoRecordset.MoveNext
Loop
adoRecordset.Close
adoConnection.Close
Set adoRecordset = Nothing
Set adoConnection = Nothing
Set adoCommand = Nothing
 
Function TimeZoneBias
    strComputer = "."
    Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
    Set colTimeZone = objWMIService.ExecQuery("Select * from Win32_TimeZone")
    For Each objTimeZone in colTimeZone
        TimeZoneBias = objTimeZone.Bias
    Next
    Set colTimeZone = Nothing
    Set objWMIService = Nothing
End Function
0
 
LVL 11

Author Comment

by:bsharath
ID: 34216525
Any way to place the user names in a txt file and query each user to get the dc names
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

786 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question