Solved

How can we find which user is authenticating from which DC.

Posted on 2010-11-25
7
345 Views
Last Modified: 2012-05-10
Hi,

How can we find which user is authenticating from which DC.

i want to know say which server are 1 to 1000 people geting there authentication from. is it from 1 server or many Dc's.

Can anyone help me with a procedure or a script to extract this.

regards
Raja
0
Comment
Question by:bsharath
  • 3
  • 3
7 Comments
 
LVL 25

Expert Comment

by:Tony Johncock
ID: 34213348
One quick and dirty way is a simple login script:

In bat file format (yuck) it's quick and dirty:

@Echo off
Echo %USERNAME% %LOGONSERVER% >> \\server\share\auth.txt


 
0
 
LVL 11

Author Comment

by:bsharath
ID: 34213490
Thanks but will need a way to query all users ntlogins in the list or a way to query the domain itself and find all users who got authenticated with the date and time (last)
0
 
LVL 25

Accepted Solution

by:
Tony Johncock earned 334 total points
ID: 34213556
Ok I should be able to come up with something using WMI but in the meantime, you could

@Echo off
Echo %DATE% %TIME% %USERNAME% %LOGONSERVER% >> \\server\share\auth.txt

It'll give you what you need but needless to say isn't as flexible as being able to run a script to retrieve the info.

0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 11

Author Comment

by:bsharath
ID: 34213634
thanks but to place this i have 100 approvals and a CR in middle. So an alternative would be helpful...
0
 
LVL 10

Assisted Solution

by:dhruvarajp
dhruvarajp earned 166 total points
ID: 34214363
you can use
set L
command on the workstation to get the logonservers.

create a script around it


0
 
LVL 25

Assisted Solution

by:Tony Johncock
Tony Johncock earned 334 total points
ID: 34216252
This is actually difficult - getting the last logon time is fairly easy but the authenticating server is not so easy(!).

Not sure it's going to be attainable by script.

However, there might be tools that can do it for free:

http://www.manageengine.com/products/free-windows-active-directory-tools/free-windows-active-directory-query-tool.html

http://maxpowersoft.com/adreportslite.php

VBScript to report user name & logon time (use cscript otherwise, you get a popup for every username in wscript - save it to a file, then cscript file.vbs from a command prompt):

intBias = TimeZoneBias
arrAttributes = Array("lastLogonTimeStamp","displayname","mail")
 
Set adoCommand = CreateObject("ADODB.Command")
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"
adoCommand.ActiveConnection = adoConnection
 
Set objRootDSE = GetObject("LDAP://RootDSE")
strBase = "<LDAP://" & objRootDSE.Get("defaultNamingContext") & ">"
Set objRootDSE = Nothing
 
strFilter = "(&(objectCategory=person)(objectClass=user))"
strAttributes = Join(arrAttributes,",")
Wscript.Echo Join(arrAttributes,";")
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
adoCommand.CommandText = strQuery
adoCommand.Properties("Page Size") = 100
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False
Set adoRecordset = adoCommand.Execute
Do Until adoRecordset.EOF
    On Error Resume Next
    strTempOutput = ""
    For i = 1 To Ubound(arrAttributes)
        strTempOutput =  strTempOutput & " ; " & adoRecordset.Fields(arrAttributes(i)).Value
        strOutput = Mid(Ltrim(strTempOutput),3)
    Next
    Set objDate = adoRecordset.Fields(arrAttributes(0)).Value
    If (Err.Number <> 0) Then
        dtmDate = #1/1/1601#
    Else
        dtmDate = ((((objDate.Highpart * (2^32)) + objDate.LowPart)/(600000000 - intBias))/1440) + #1/1/1601#
    End If
    Set objDate = Nothing
    Wscript.Echo strOutput & " ; " & dtmDate
    adoRecordset.MoveNext
Loop
adoRecordset.Close
adoConnection.Close
Set adoRecordset = Nothing
Set adoConnection = Nothing
Set adoCommand = Nothing
 
Function TimeZoneBias
    strComputer = "."
    Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
    Set colTimeZone = objWMIService.ExecQuery("Select * from Win32_TimeZone")
    For Each objTimeZone in colTimeZone
        TimeZoneBias = objTimeZone.Bias
    Next
    Set colTimeZone = Nothing
    Set objWMIService = Nothing
End Function
0
 
LVL 11

Author Comment

by:bsharath
ID: 34216525
Any way to place the user names in a txt file and query each user to get the dc names
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
The viewer will learn how to count occurrences of each item in an array.
how to add IIS SMTP to handle application/Scanner relays into office 365.

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question