Solved

Find out which maschine is using an specific old useraccount for logon

Posted on 2015-01-21
4
98 Views
Last Modified: 2015-01-29
Hi,

we have a Windows 2012 Domain Controller. I noticed that an old (but still not deactived) useraccount is still used. After setting up a new destination for roaming profiles, this Account created a profile-folder too.
Before deactivating it, i want to know from which machine the logon comes.
How do i find out this ?
I only know the username and the DC the users authenticates against.

Thanks for answers
0
Comment
Question by:loosain
4 Comments
 
LVL 35

Accepted Solution

by:
Kimputer earned 167 total points
ID: 40563270
Take a look in the Event Viewer, Security log. You can filter on the username. If nothing is there, you need to enable auditing. If there are entries after you filter it, just take a look at the entries, it should reveal the ip number.
0
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 167 total points
ID: 40563507
If you have multiple domain controllers then you are going to have to go through all of the DC logs on each server.

You will also need to increase the security log database to something larger than the defaults. This is so that the event logs do not get overwritten.

You also require auditing to be enabled via the default domain policy. If this is not set you will see nothing in the logs. These auditing settings are not enabled by default.

If you have multiple DC's I would suggest using something like AD Audit PLUS. You can get a fully functional version for 30 trail.

http://www.manageengine.com/products/active-directory-audit/download.html

Will.
0
 
LVL 8

Assisted Solution

by:MarkieS
MarkieS earned 166 total points
ID: 40565931
If you know the user account password - try changing it to something different.
You can then use  Powershell to locate the machine
http://blogs.technet.com/b/heyscriptingguy/archive/2012/12/27/use-powershell-to-find-the-location-of-a-locked-out-user.aspx
0
 

Author Closing Comment

by:loosain
ID: 40577160
It was an error from the customer. He talked about the wrong user. Everything was fine. But thanks for the advises, maybe helping next time.
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question