Solved

How can we find which user is authenticating from which DC.

Posted on 2010-11-25
7
321 Views
Last Modified: 2012-05-10
Hi,

How can we find which user is authenticating from which DC.

i want to know say which server are 1 to 1000 people geting there authentication from. is it from 1 server or many Dc's.

Can anyone help me with a procedure or a script to extract this.

regards
Raja
0
Comment
Question by:bsharath
  • 3
  • 3
7 Comments
 
LVL 25

Expert Comment

by:Tony1044
ID: 34213348
One quick and dirty way is a simple login script:

In bat file format (yuck) it's quick and dirty:

@Echo off
Echo %USERNAME% %LOGONSERVER% >> \\server\share\auth.txt


 
0
 
LVL 11

Author Comment

by:bsharath
ID: 34213490
Thanks but will need a way to query all users ntlogins in the list or a way to query the domain itself and find all users who got authenticated with the date and time (last)
0
 
LVL 25

Accepted Solution

by:
Tony1044 earned 334 total points
ID: 34213556
Ok I should be able to come up with something using WMI but in the meantime, you could

@Echo off
Echo %DATE% %TIME% %USERNAME% %LOGONSERVER% >> \\server\share\auth.txt

It'll give you what you need but needless to say isn't as flexible as being able to run a script to retrieve the info.

0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 11

Author Comment

by:bsharath
ID: 34213634
thanks but to place this i have 100 approvals and a CR in middle. So an alternative would be helpful...
0
 
LVL 10

Assisted Solution

by:dhruvarajp
dhruvarajp earned 166 total points
ID: 34214363
you can use
set L
command on the workstation to get the logonservers.

create a script around it


0
 
LVL 25

Assisted Solution

by:Tony1044
Tony1044 earned 334 total points
ID: 34216252
This is actually difficult - getting the last logon time is fairly easy but the authenticating server is not so easy(!).

Not sure it's going to be attainable by script.

However, there might be tools that can do it for free:

http://www.manageengine.com/products/free-windows-active-directory-tools/free-windows-active-directory-query-tool.html

http://maxpowersoft.com/adreportslite.php

VBScript to report user name & logon time (use cscript otherwise, you get a popup for every username in wscript - save it to a file, then cscript file.vbs from a command prompt):

intBias = TimeZoneBias
arrAttributes = Array("lastLogonTimeStamp","displayname","mail")
 
Set adoCommand = CreateObject("ADODB.Command")
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"
adoCommand.ActiveConnection = adoConnection
 
Set objRootDSE = GetObject("LDAP://RootDSE")
strBase = "<LDAP://" & objRootDSE.Get("defaultNamingContext") & ">"
Set objRootDSE = Nothing
 
strFilter = "(&(objectCategory=person)(objectClass=user))"
strAttributes = Join(arrAttributes,",")
Wscript.Echo Join(arrAttributes,";")
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
adoCommand.CommandText = strQuery
adoCommand.Properties("Page Size") = 100
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False
Set adoRecordset = adoCommand.Execute
Do Until adoRecordset.EOF
    On Error Resume Next
    strTempOutput = ""
    For i = 1 To Ubound(arrAttributes)
        strTempOutput =  strTempOutput & " ; " & adoRecordset.Fields(arrAttributes(i)).Value
        strOutput = Mid(Ltrim(strTempOutput),3)
    Next
    Set objDate = adoRecordset.Fields(arrAttributes(0)).Value
    If (Err.Number <> 0) Then
        dtmDate = #1/1/1601#
    Else
        dtmDate = ((((objDate.Highpart * (2^32)) + objDate.LowPart)/(600000000 - intBias))/1440) + #1/1/1601#
    End If
    Set objDate = Nothing
    Wscript.Echo strOutput & " ; " & dtmDate
    adoRecordset.MoveNext
Loop
adoRecordset.Close
adoConnection.Close
Set adoRecordset = Nothing
Set adoConnection = Nothing
Set adoCommand = Nothing
 
Function TimeZoneBias
    strComputer = "."
    Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
    Set colTimeZone = objWMIService.ExecQuery("Select * from Win32_TimeZone")
    For Each objTimeZone in colTimeZone
        TimeZoneBias = objTimeZone.Bias
    Next
    Set colTimeZone = Nothing
    Set objWMIService = Nothing
End Function
0
 
LVL 11

Author Comment

by:bsharath
ID: 34216525
Any way to place the user names in a txt file and query each user to get the dc names
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Utilizing an array to gracefully append to a list of EmailAddresses
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This video discusses moving either the default database or any database to a new volume.

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now