Member Avatar for cguan_77

hi guys, in windows 2008 how to check the particular user account is connected to what? thanks...

  • 2 Contributors
  • 3 Replies
  • 110 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by sknake

Dani AI

Generated

found an account visible on the server that did not appear in the domain list; suggested checking directory and login logs. The following practical steps explain how to tell whether the account is local or domain, where to find authoritative authentication records, and which tools can help pinpoint the workstation that authenticated it.

First, distinguish a local SAM account from a domain account. On a member server, the account will appear in the local Users store; on a domain controller there are no local accounts. A quick command to see the account's SID and the domain column is:

wmic useraccount where name="mysteryuser" get Name,SID,Domain

If the Domain column shows the machine name, it is a local account; if it shows the AD domain, it is a domain account.

For domain-authenticated logons the authoritative source is the Security log on the domain controllers. Successful interactive/authentication entries (Event ID 4624 on modern Windows) include fields such as Account Name, Workstation Name and Source Network Address. A simple PowerShell approach to search recent DC logs for that username is:

$User='mysteryuser'
$DCs = 'DC01','DC02'
Get-WinEvent -ComputerName $DCs -FilterHashtable @{LogName='Security';Id=4624;StartTime=(Get-Date).AddDays(-7)} |
  Where-Object { $_.Message -match $User } |
  Select-Object TimeCreated, MachineName, @{Name='Message';Expression={$_.Message}} |
  Format-List

If the environment lacks remote Get-WinEvent support, run the search locally on each DC or use Invoke-Command.

Useful complementary tools and notes: Sysinternals PsLoggedOn can show interactive sessions and remote logons (see PsLoggedOn), and query user / quser shows terminal services sessions on a host. To see when an AD account last authenticated, check the lastLogon/lastLogonTimestamp attributes (use Get-ADUser; note lastLogon is not replicated). If the account looks suspicious, disable it, reset credentials, review DC security logs for related activity, and run an offline/more thorough malware scan.

References: Microsoft Event 4624 documentation (logon event details) and the Sysinternals PsLoggedOn download page: Event ID 4624 | PsLoggedOn | Get-ADUser (PowerShell)

Recommended Answers

All 3 Replies

Member Avatar for sknake

I don't understand the question but I suppose you could query active directory in a domain environment.

Member Avatar for cguan_77

thanks sknake for your reply..sorry if my question is confusing...to elaborate further.. recently the server caught some virus..but run Norton and seems to be fine.. cross my fingers that everything will be okay...

so I just noticed that in Active Directory there was a user name in which I didn't add, so I deleted that particular user name.. then I went to command prompt then do a "net user " command... then I tried to compare those user names in the AD list.. but i noticed that at the command prompt there's one user name that is listed there but not in the AD list..

so I want to check which domain or computer that particular user is connected to? it's not listed on the AD list..but is listed on the net user list at command prompt.. anyway I tried your suggestion to query in the AD list..
:)

Member Avatar for sknake

Oh .. now that i'm not sure about. We have another guy here who handles all the domain & windows networking. I have seen an active directory log in the windows event viewer that contains verbose information about user logins. I think it gives the machine they authenticated on, IP, when they logged in, etc. Have you checked the logs?

I understand what you are asking -- and i'm sure there is a way. But off hand I dont know.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.