User monitoring

  • Thread starter Thread starter Andy
  • Start date Start date
A

Andy

Hi
Is there a tool which will query AD and return info on which users are
currently logged on to any AD server (single domain) or last logon
date/time? Also need computer name logged onto and IP address. I need to be
able to track student logins on the network. Setup is Win2000 AD XP and 98
clients

Thanks
Andrew
 
There is not built in way to find out currently logged on users without
using a third party tool or implementing the cconnect Resource Kit tool on
the domain that requires a client component on each computer and the use of
a SQL server. There is a free PsLoggedOn utility from SysInternals that may
be of some help.

http://www.sysinternals.com/ntw2k/freeware/psloggedon.shtml -- PsLoggedOn

You can enable auditing of account logon events in Domain Controller
Security Policy to find when users have logged onto the domain and audit
logon evnts on domain computers to find out when any user has logged on
locally to a domain computer. See the link below for more info on auditing.
Be sure to read the part on using Event Comb to scan remote computer logs
for needed events or text searches. Account logon events will be recorded on
the domain controller that authenticates the user and computer names may be
recorded instead of IP addresses but you shoould be able to ping a computer
by name if it is turned on the find the IP address or look in the wins, dns
zones, and dhcp leases for possible IP to name mappings.

http://www.microsoft.com/technet/security/guidance/secmod144.mspx

There is also a free tool from Somar Soft that will give you a list of users
and last time they logged on called Dumpsec. Take a look at the reports for
users and the options you can add to the report. --- Steve

http://www.somarsoft.com/
 
Back
Top