Determining When a Domain Account Was Last Used

[Guest Phil McNeill]

I know how to determine the last time a W2K3 domain account was used to

logon to the domain, but how would I go about determining the last time a

domain account was used for a purpose other than an interactive logon? For

example, to start a Windows service on a member server, or to run a

scheduled task in the Windows Task Scheduler.

 

Basically, I'm performing a cleanup of domain accounts and trying to

determine what's actually being used and what's not being used. It's easy

with user accounts, but a little more challenging with accounts that aren't

used for interactive logons. We're in an environment with several domain

controllers and many member servers.

 

Any suggestions appreciated. Thanks!

 

Phil

[Guest SlowBob]

RE: Determining When a Domain Account Was Last Used

 

 

 

"Phil McNeill" wrote:

> I know how to determine the last time a W2K3 domain account was used to

> logon to the domain, but how would I go about determining the last time a

> domain account was used for a purpose other than an interactive logon? For

> example, to start a Windows service on a member server, or to run a

> scheduled task in the Windows Task Scheduler.

>

> Basically, I'm performing a cleanup of domain accounts and trying to

> determine what's actually being used and what's not being used. It's easy

> with user accounts, but a little more challenging with accounts that aren't

> used for interactive logons. We're in an environment with several domain

> controllers and many member servers.

>

> Any suggestions appreciated. Thanks!

>

> Phil

>

>

>

 

This article in TechNet may help:

 

http://www.microsoft.com/technet/technetmag/issues/2006/01/ScriptingGuy/default.aspx

[Guest Steve Goddard]

RE: Determining When a Domain Account Was Last Used

 

For user accounts wouldn't it be easier to set account password expiration,

then trawl the domain accounts for any that the password is 'stale'?

 

As for find accounts that run services and scheduled tasks an individual

audit per server? Several scripts could return information.

 

--

Steve G.

MCSA 2003 +M

 

 

"Phil McNeill" wrote:

> I know how to determine the last time a W2K3 domain account was used to

> logon to the domain, but how would I go about determining the last time a

> domain account was used for a purpose other than an interactive logon? For

> example, to start a Windows service on a member server, or to run a

> scheduled task in the Windows Task Scheduler.

>

> Basically, I'm performing a cleanup of domain accounts and trying to

> determine what's actually being used and what's not being used. It's easy

> with user accounts, but a little more challenging with accounts that aren't

> used for interactive logons. We're in an environment with several domain

> controllers and many member servers.

>

> Any suggestions appreciated. Thanks!

>

> Phil

>

>

>

[Guest FortyPoundHead]

Re: Determining When a Domain Account Was Last Used

 

On Feb 8, 11:25 am, "Phil McNeill"

<philmcne...@REMOVETEXTINCAPShydroottawa.com> wrote:

> I know how to determine the last time a W2K3 domain account was used to

> logon to the domain, but how would I go about determining the last time a

> domain account was used for a purpose other than an interactive logon? For

> example, to start a Windows service on a member server, or to run a

> scheduled task in the Windows Task Scheduler.

>

> Basically, I'm performing a cleanup of domain accounts and trying to

> determine what's actually being used and what's not being used. It's easy

> with user accounts, but a little more challenging with accounts that aren't

> used for interactive logons. We're in an environment with several domain

> controllers and many member servers.

>

> Any suggestions appreciated. Thanks!

>

> Phil

 

Hi Phil -

 

Have you tried DumpSec (http://www.somarsoft.com/)? I've used it in

the past to get true last logon info, and it seems to work pretty

good.

 

HTH,

Derek

http://www.fortypoundhead.com

[Guest Phil McNeill]

Re: Determining When a Domain Account Was Last Used

 

 

"Phil McNeill" <philmcneill@REMOVETEXTINCAPShydroottawa.com> wrote in

message news:euSzfhoaIHA.1376@TK2MSFTNGP02.phx.gbl...

>I know how to determine the last time a W2K3 domain account was used to

>logon to the domain, but how would I go about determining the last time a

>domain account was used for a purpose other than an interactive logon? For

>example, to start a Windows service on a member server, or to run a

>scheduled task in the Windows Task Scheduler.

>

> Basically, I'm performing a cleanup of domain accounts and trying to

> determine what's actually being used and what's not being used. It's easy

> with user accounts, but a little more challenging with accounts that

> aren't used for interactive logons. We're in an environment with several

> domain controllers and many member servers.

>

> Any suggestions appreciated. Thanks!

>

> Phil

>

 

Thanks for the suggestions guys. Unfortuantely, everything is geared

towards determining the last interactive login, which is pretty much as I

expected. Looks like it will be a server by server thing to track down what

is and what is not being used.

 

Thanks again!