Solved

Find out which maschine is using an specific old useraccount for logon

Posted on 2015-01-21
4
97 Views
Last Modified: 2015-01-29
Hi,

we have a Windows 2012 Domain Controller. I noticed that an old (but still not deactived) useraccount is still used. After setting up a new destination for roaming profiles, this Account created a profile-folder too.
Before deactivating it, i want to know from which machine the logon comes.
How do i find out this ?
I only know the username and the DC the users authenticates against.

Thanks for answers
0
Comment
Question by:loosain
4 Comments
 
LVL 35

Accepted Solution

by:
Kimputer earned 167 total points
ID: 40563270
Take a look in the Event Viewer, Security log. You can filter on the username. If nothing is there, you need to enable auditing. If there are entries after you filter it, just take a look at the entries, it should reveal the ip number.
0
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 167 total points
ID: 40563507
If you have multiple domain controllers then you are going to have to go through all of the DC logs on each server.

You will also need to increase the security log database to something larger than the defaults. This is so that the event logs do not get overwritten.

You also require auditing to be enabled via the default domain policy. If this is not set you will see nothing in the logs. These auditing settings are not enabled by default.

If you have multiple DC's I would suggest using something like AD Audit PLUS. You can get a fully functional version for 30 trail.

http://www.manageengine.com/products/active-directory-audit/download.html

Will.
0
 
LVL 8

Assisted Solution

by:MarkieS
MarkieS earned 166 total points
ID: 40565931
If you know the user account password - try changing it to something different.
You can then use  Powershell to locate the machine
http://blogs.technet.com/b/heyscriptingguy/archive/2012/12/27/use-powershell-to-find-the-location-of-a-locked-out-user.aspx
0
 

Author Closing Comment

by:loosain
ID: 40577160
It was an error from the customer. He talked about the wrong user. Everything was fine. But thanks for the advises, maybe helping next time.
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question