Solved

How can we find which user is authenticating from which DC.

Posted on 2010-11-25
7
359 Views
Last Modified: 2012-05-10
Hi,

How can we find which user is authenticating from which DC.

i want to know say which server are 1 to 1000 people geting there authentication from. is it from 1 server or many Dc's.

Can anyone help me with a procedure or a script to extract this.

regards
Raja
0
Comment
Question by:bsharath
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
7 Comments
 
LVL 26

Expert Comment

by:Tony Johncock
ID: 34213348
One quick and dirty way is a simple login script:

In bat file format (yuck) it's quick and dirty:

@Echo off
Echo %USERNAME% %LOGONSERVER% >> \\server\share\auth.txt


 
0
 
LVL 11

Author Comment

by:bsharath
ID: 34213490
Thanks but will need a way to query all users ntlogins in the list or a way to query the domain itself and find all users who got authenticated with the date and time (last)
0
 
LVL 26

Accepted Solution

by:
Tony Johncock earned 334 total points
ID: 34213556
Ok I should be able to come up with something using WMI but in the meantime, you could

@Echo off
Echo %DATE% %TIME% %USERNAME% %LOGONSERVER% >> \\server\share\auth.txt

It'll give you what you need but needless to say isn't as flexible as being able to run a script to retrieve the info.

0
Instantly Create Instructional Tutorials

Contextual Guidance at the moment of need helps your employees adopt to new software or processes instantly. Boost knowledge retention and employee engagement step-by-step with one easy solution.

 
LVL 11

Author Comment

by:bsharath
ID: 34213634
thanks but to place this i have 100 approvals and a CR in middle. So an alternative would be helpful...
0
 
LVL 10

Assisted Solution

by:dhruvarajp
dhruvarajp earned 166 total points
ID: 34214363
you can use
set L
command on the workstation to get the logonservers.

create a script around it


0
 
LVL 26

Assisted Solution

by:Tony Johncock
Tony Johncock earned 334 total points
ID: 34216252
This is actually difficult - getting the last logon time is fairly easy but the authenticating server is not so easy(!).

Not sure it's going to be attainable by script.

However, there might be tools that can do it for free:

http://www.manageengine.com/products/free-windows-active-directory-tools/free-windows-active-directory-query-tool.html

http://maxpowersoft.com/adreportslite.php

VBScript to report user name & logon time (use cscript otherwise, you get a popup for every username in wscript - save it to a file, then cscript file.vbs from a command prompt):

intBias = TimeZoneBias
arrAttributes = Array("lastLogonTimeStamp","displayname","mail")
 
Set adoCommand = CreateObject("ADODB.Command")
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"
adoCommand.ActiveConnection = adoConnection
 
Set objRootDSE = GetObject("LDAP://RootDSE")
strBase = "<LDAP://" & objRootDSE.Get("defaultNamingContext") & ">"
Set objRootDSE = Nothing
 
strFilter = "(&(objectCategory=person)(objectClass=user))"
strAttributes = Join(arrAttributes,",")
Wscript.Echo Join(arrAttributes,";")
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
adoCommand.CommandText = strQuery
adoCommand.Properties("Page Size") = 100
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False
Set adoRecordset = adoCommand.Execute
Do Until adoRecordset.EOF
    On Error Resume Next
    strTempOutput = ""
    For i = 1 To Ubound(arrAttributes)
        strTempOutput =  strTempOutput & " ; " & adoRecordset.Fields(arrAttributes(i)).Value
        strOutput = Mid(Ltrim(strTempOutput),3)
    Next
    Set objDate = adoRecordset.Fields(arrAttributes(0)).Value
    If (Err.Number <> 0) Then
        dtmDate = #1/1/1601#
    Else
        dtmDate = ((((objDate.Highpart * (2^32)) + objDate.LowPart)/(600000000 - intBias))/1440) + #1/1/1601#
    End If
    Set objDate = Nothing
    Wscript.Echo strOutput & " ; " & dtmDate
    adoRecordset.MoveNext
Loop
adoRecordset.Close
adoConnection.Close
Set adoRecordset = Nothing
Set adoConnection = Nothing
Set adoCommand = Nothing
 
Function TimeZoneBias
    strComputer = "."
    Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
    Set colTimeZone = objWMIService.ExecQuery("Select * from Win32_TimeZone")
    For Each objTimeZone in colTimeZone
        TimeZoneBias = objTimeZone.Bias
    Next
    Set colTimeZone = Nothing
    Set objWMIService = Nothing
End Function
0
 
LVL 11

Author Comment

by:bsharath
ID: 34216525
Any way to place the user names in a txt file and query each user to get the dc names
0

Featured Post

Edgartown IT Case Study

Learn about Edgartown's quest to ensure the safety and security of the entire town's employee and citizen data. Read the case study!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
This article will help to fix the below errors for MS Exchange Server 2013 I. Certificate error "name on the security certificate is invalid or does not match the name of the site" II. Out of Office not working III. Make Internal URLs and Externa…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question