Solved

How can we find which user is authenticating from which DC.

Posted on 2010-11-25
7
331 Views
Last Modified: 2012-05-10
Hi,

How can we find which user is authenticating from which DC.

i want to know say which server are 1 to 1000 people geting there authentication from. is it from 1 server or many Dc's.

Can anyone help me with a procedure or a script to extract this.

regards
Raja
0
Comment
Question by:bsharath
  • 3
  • 3
7 Comments
 
LVL 25

Expert Comment

by:Tony1044
ID: 34213348
One quick and dirty way is a simple login script:

In bat file format (yuck) it's quick and dirty:

@Echo off
Echo %USERNAME% %LOGONSERVER% >> \\server\share\auth.txt


 
0
 
LVL 11

Author Comment

by:bsharath
ID: 34213490
Thanks but will need a way to query all users ntlogins in the list or a way to query the domain itself and find all users who got authenticated with the date and time (last)
0
 
LVL 25

Accepted Solution

by:
Tony1044 earned 334 total points
ID: 34213556
Ok I should be able to come up with something using WMI but in the meantime, you could

@Echo off
Echo %DATE% %TIME% %USERNAME% %LOGONSERVER% >> \\server\share\auth.txt

It'll give you what you need but needless to say isn't as flexible as being able to run a script to retrieve the info.

0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 11

Author Comment

by:bsharath
ID: 34213634
thanks but to place this i have 100 approvals and a CR in middle. So an alternative would be helpful...
0
 
LVL 10

Assisted Solution

by:dhruvarajp
dhruvarajp earned 166 total points
ID: 34214363
you can use
set L
command on the workstation to get the logonservers.

create a script around it


0
 
LVL 25

Assisted Solution

by:Tony1044
Tony1044 earned 334 total points
ID: 34216252
This is actually difficult - getting the last logon time is fairly easy but the authenticating server is not so easy(!).

Not sure it's going to be attainable by script.

However, there might be tools that can do it for free:

http://www.manageengine.com/products/free-windows-active-directory-tools/free-windows-active-directory-query-tool.html

http://maxpowersoft.com/adreportslite.php

VBScript to report user name & logon time (use cscript otherwise, you get a popup for every username in wscript - save it to a file, then cscript file.vbs from a command prompt):

intBias = TimeZoneBias
arrAttributes = Array("lastLogonTimeStamp","displayname","mail")
 
Set adoCommand = CreateObject("ADODB.Command")
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"
adoCommand.ActiveConnection = adoConnection
 
Set objRootDSE = GetObject("LDAP://RootDSE")
strBase = "<LDAP://" & objRootDSE.Get("defaultNamingContext") & ">"
Set objRootDSE = Nothing
 
strFilter = "(&(objectCategory=person)(objectClass=user))"
strAttributes = Join(arrAttributes,",")
Wscript.Echo Join(arrAttributes,";")
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
adoCommand.CommandText = strQuery
adoCommand.Properties("Page Size") = 100
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False
Set adoRecordset = adoCommand.Execute
Do Until adoRecordset.EOF
    On Error Resume Next
    strTempOutput = ""
    For i = 1 To Ubound(arrAttributes)
        strTempOutput =  strTempOutput & " ; " & adoRecordset.Fields(arrAttributes(i)).Value
        strOutput = Mid(Ltrim(strTempOutput),3)
    Next
    Set objDate = adoRecordset.Fields(arrAttributes(0)).Value
    If (Err.Number <> 0) Then
        dtmDate = #1/1/1601#
    Else
        dtmDate = ((((objDate.Highpart * (2^32)) + objDate.LowPart)/(600000000 - intBias))/1440) + #1/1/1601#
    End If
    Set objDate = Nothing
    Wscript.Echo strOutput & " ; " & dtmDate
    adoRecordset.MoveNext
Loop
adoRecordset.Close
adoConnection.Close
Set adoRecordset = Nothing
Set adoConnection = Nothing
Set adoCommand = Nothing
 
Function TimeZoneBias
    strComputer = "."
    Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
    Set colTimeZone = objWMIService.ExecQuery("Select * from Win32_TimeZone")
    For Each objTimeZone in colTimeZone
        TimeZoneBias = objTimeZone.Bias
    Next
    Set colTimeZone = Nothing
    Set objWMIService = Nothing
End Function
0
 
LVL 11

Author Comment

by:bsharath
ID: 34216525
Any way to place the user names in a txt file and query each user to get the dc names
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Find out what you should include to make the best professional email signature for your organization.
This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
The viewer will learn the basics of jQuery, including how to invoke it on a web page. Reference your jQuery libraries: (CODE) Include your new external js/jQuery file: (CODE) Write your first lines of code to setup your site for jQuery.: (CODE)
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now