Solved

Find out which maschine is using an specific old useraccount for logon

Posted on 2015-01-21
4
94 Views
Last Modified: 2015-01-29
Hi,

we have a Windows 2012 Domain Controller. I noticed that an old (but still not deactived) useraccount is still used. After setting up a new destination for roaming profiles, this Account created a profile-folder too.
Before deactivating it, i want to know from which machine the logon comes.
How do i find out this ?
I only know the username and the DC the users authenticates against.

Thanks for answers
0
Comment
Question by:loosain
4 Comments
 
LVL 35

Accepted Solution

by:
Kimputer earned 167 total points
ID: 40563270
Take a look in the Event Viewer, Security log. You can filter on the username. If nothing is there, you need to enable auditing. If there are entries after you filter it, just take a look at the entries, it should reveal the ip number.
0
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 167 total points
ID: 40563507
If you have multiple domain controllers then you are going to have to go through all of the DC logs on each server.

You will also need to increase the security log database to something larger than the defaults. This is so that the event logs do not get overwritten.

You also require auditing to be enabled via the default domain policy. If this is not set you will see nothing in the logs. These auditing settings are not enabled by default.

If you have multiple DC's I would suggest using something like AD Audit PLUS. You can get a fully functional version for 30 trail.

http://www.manageengine.com/products/active-directory-audit/download.html

Will.
0
 
LVL 8

Assisted Solution

by:MarkieS
MarkieS earned 166 total points
ID: 40565931
If you know the user account password - try changing it to something different.
You can then use  Powershell to locate the machine
http://blogs.technet.com/b/heyscriptingguy/archive/2012/12/27/use-powershell-to-find-the-location-of-a-locked-out-user.aspx
0
 

Author Closing Comment

by:loosain
ID: 40577160
It was an error from the customer. He talked about the wrong user. Everything was fine. But thanks for the advises, maybe helping next time.
0

Join & Write a Comment

This article will review the basic installation and configuration for Windows Software Update Services (WSUS) in a Windows 2012 R2 environment.  WSUS is a Microsoft tool that allows administrators to manage and control updates to be approved and ins…
What to do when Windows Update is not working correctly? What tools can I use to detect the cause of the malfunction problem? What does this numeric error code mean? These and other questions that you have been asking in the past are answered here (…
In this Micro Tutorial viewers will learn how to use Windows Server Backup to create full image of their system. Tutorial shows how to install Windows Server Backup Feature on Windows 2012R2 and how to configure scheduled Bare Metal Recovery backup.…
In this Micro Tutorial viewers will learn how to use Boot Corrector from Paragon Rescue Kit Free to identify and fix the boot problems of Windows 7/8/2012R2 etc. As an example is used Windows 2012R2 which lost its active partition flag (often happen…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now