?
Solved

AD and DNS Logging

Posted on 2011-02-28
6
Medium Priority
?
840 Views
Last Modified: 2012-05-11
How do I found out what IP addresses are authenticating to a Windows Server 2003 Domain Controller. I am retiring a Domain and need to verify how many machines are still actively logging into this Domain so that these users can be contacted prior to retiring. I turned on DNS Log Queries but this does not give me much.

Thanks!
0
Comment
Question by:Darrell Kirby
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 57

Expert Comment

by:Mike Kline
ID: 35002198
There are different logging levels you can look at  http://support.microsoft.com/kb/314980  or the security event logs

....but really you don't need to users don't need to do anything.  You updated their DNS server IPs (if those change) but the client (XP, 7, etc) is smart enough to pick another DC for authentication.

Thanks

Mike
0
 
LVL 31

Expert Comment

by:Justin Owens
ID: 35002262
Another suggestion would be to check Active Directory Sites and Services and see if there are any defined sites and subnets in AD.  Even then, that is a suggested server, not a "mandated only" server.  Mike is correct in that it should just be safe to remove.

DrUltima
0
 
LVL 11

Expert Comment

by:Renato Montenegro Rustici
ID: 35002916
Try raizing the net logon logging:

Enabling debug logging for the Net Logon service
http://support.microsoft.com/kb/109626

I usually use this to find out what ip addresses with no AD sites are logging to a domain controller (no modification to logging level is needed). Maybe you can do it by raizing the logging.

I'm wondering something. Maybe you can create an additional AD site. Then, do not associate any subnets to it. Move your domain controller to this new site. The log may start to show you what IP addresses are logging on your server.

Another clear choices would be to use tcpview, netmon or wireshark.
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 
LVL 7

Expert Comment

by:elawad
ID: 35004754
is the forward lookup zone of the retired domain still exists or you also deleted it, if its still exists the computers that are still joined to that domain will register themselves in the zone. and that is how you can check who is still on that domain. and if you delete it just recreate it and you should be fine.
0
 
LVL 3

Expert Comment

by:InterframeGap
ID: 35008314
I would look at using WMI or ADSI -

Many scripts at the scripting center which may help you here is the dhcp specific scripts:
http://gallery.technet.microsoft.com/scriptcenter/site/search?f%5B0%5D.Type=SearchText&f%5B0%5D.Value=dhcp&x=0&y=0

Read the information well and understand the scripts intentions and make sure that you are comfortable using the script in its current form.  If you have questions, the forum there is very good and well respected.

DMT
0
 
LVL 11

Accepted Solution

by:
Renato Montenegro Rustici earned 1000 total points
ID: 35009857
I did the test. It seems to work just fine. Here is the step by step:

1) Raise the netlogon debug level in the domain controller:

nltest /dbflag:0x2080ffff

2) Restart the netlogon service in order to the flag take effect:

net stop netlogon && net start netlogon

3) Leave the flag for a period of time collecting the data. When you think it's enough, just turn it off and restart the netlogon:

nltest /dbflag:0x0
net stop netlogon && net start netlogon

----------------------

Ok, you can inspect the netlogon file while the logging is running or after some hours. You pick.

To summarize the results, run a findstr to collect only the authentication:

findstr -l "NetrServerAuthenticate returns Success" C:\Windows\Debug\netlogon.log > auths.txt

You can now open this txt in Excel and filter the data (extract the computer names, eliminate the duplicates, etc).

See if that works for you.
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Did you know that more than 4 billion data records have been recorded as lost or stolen since 2013? It was a staggering number brought to our attention during last week’s ManageEngine webinar, where attendees received a comprehensive look at the ma…
Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…
Suggested Courses
Course of the Month14 days, 16 hours left to enroll

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question