Solved

Find out which maschine is using an specific old useraccount for logon

Posted on 2015-01-21
4
102 Views
Last Modified: 2015-01-29
Hi,

we have a Windows 2012 Domain Controller. I noticed that an old (but still not deactived) useraccount is still used. After setting up a new destination for roaming profiles, this Account created a profile-folder too.
Before deactivating it, i want to know from which machine the logon comes.
How do i find out this ?
I only know the username and the DC the users authenticates against.

Thanks for answers
0
Comment
Question by:loosain
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 35

Accepted Solution

by:
Kimputer earned 167 total points
ID: 40563270
Take a look in the Event Viewer, Security log. You can filter on the username. If nothing is there, you need to enable auditing. If there are entries after you filter it, just take a look at the entries, it should reveal the ip number.
0
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 167 total points
ID: 40563507
If you have multiple domain controllers then you are going to have to go through all of the DC logs on each server.

You will also need to increase the security log database to something larger than the defaults. This is so that the event logs do not get overwritten.

You also require auditing to be enabled via the default domain policy. If this is not set you will see nothing in the logs. These auditing settings are not enabled by default.

If you have multiple DC's I would suggest using something like AD Audit PLUS. You can get a fully functional version for 30 trail.

http://www.manageengine.com/products/active-directory-audit/download.html

Will.
0
 
LVL 8

Assisted Solution

by:MarkieS
MarkieS earned 166 total points
ID: 40565931
If you know the user account password - try changing it to something different.
You can then use  Powershell to locate the machine
http://blogs.technet.com/b/heyscriptingguy/archive/2012/12/27/use-powershell-to-find-the-location-of-a-locked-out-user.aspx
0
 

Author Closing Comment

by:loosain
ID: 40577160
It was an error from the customer. He talked about the wrong user. Everything was fine. But thanks for the advises, maybe helping next time.
0

Featured Post

What Is Transaction Monitoring and who needs it?

Synthetic Transaction Monitoring that you need for the day to day, which ensures your business website keeps running optimally, and that there is no downtime to impact your customer experience.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
A company’s centralized system that manages user data, security, and distributed resources is often a focus of criminal attention. Active Directory (AD) is no exception. In truth, it’s even more likely to be targeted due to the number of companies …
In this Micro Tutorial viewers will learn how they can get their files copied out from their unbootable system without need to use recovery services. As an example non-bootable Windows 2012R2 installation is used which has boot problems.
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question