Guest Phil McNeill Posted February 8, 2008 Posted February 8, 2008 I know how to determine the last time a W2K3 domain account was used to logon to the domain, but how would I go about determining the last time a domain account was used for a purpose other than an interactive logon? For example, to start a Windows service on a member server, or to run a scheduled task in the Windows Task Scheduler. Basically, I'm performing a cleanup of domain accounts and trying to determine what's actually being used and what's not being used. It's easy with user accounts, but a little more challenging with accounts that aren't used for interactive logons. We're in an environment with several domain controllers and many member servers. Any suggestions appreciated. Thanks! Phil
Guest SlowBob Posted February 8, 2008 Posted February 8, 2008 RE: Determining When a Domain Account Was Last Used "Phil McNeill" wrote: > I know how to determine the last time a W2K3 domain account was used to > logon to the domain, but how would I go about determining the last time a > domain account was used for a purpose other than an interactive logon? For > example, to start a Windows service on a member server, or to run a > scheduled task in the Windows Task Scheduler. > > Basically, I'm performing a cleanup of domain accounts and trying to > determine what's actually being used and what's not being used. It's easy > with user accounts, but a little more challenging with accounts that aren't > used for interactive logons. We're in an environment with several domain > controllers and many member servers. > > Any suggestions appreciated. Thanks! > > Phil > > > This article in TechNet may help: http://www.microsoft.com/technet/technetmag/issues/2006/01/ScriptingGuy/default.aspx
Guest Steve Goddard Posted February 8, 2008 Posted February 8, 2008 RE: Determining When a Domain Account Was Last Used For user accounts wouldn't it be easier to set account password expiration, then trawl the domain accounts for any that the password is 'stale'? As for find accounts that run services and scheduled tasks an individual audit per server? Several scripts could return information. -- Steve G. MCSA 2003 +M "Phil McNeill" wrote: > I know how to determine the last time a W2K3 domain account was used to > logon to the domain, but how would I go about determining the last time a > domain account was used for a purpose other than an interactive logon? For > example, to start a Windows service on a member server, or to run a > scheduled task in the Windows Task Scheduler. > > Basically, I'm performing a cleanup of domain accounts and trying to > determine what's actually being used and what's not being used. It's easy > with user accounts, but a little more challenging with accounts that aren't > used for interactive logons. We're in an environment with several domain > controllers and many member servers. > > Any suggestions appreciated. Thanks! > > Phil > > >
Guest FortyPoundHead Posted February 9, 2008 Posted February 9, 2008 Re: Determining When a Domain Account Was Last Used On Feb 8, 11:25 am, "Phil McNeill" <philmcne...@REMOVETEXTINCAPShydroottawa.com> wrote: > I know how to determine the last time a W2K3 domain account was used to > logon to the domain, but how would I go about determining the last time a > domain account was used for a purpose other than an interactive logon? For > example, to start a Windows service on a member server, or to run a > scheduled task in the Windows Task Scheduler. > > Basically, I'm performing a cleanup of domain accounts and trying to > determine what's actually being used and what's not being used. It's easy > with user accounts, but a little more challenging with accounts that aren't > used for interactive logons. We're in an environment with several domain > controllers and many member servers. > > Any suggestions appreciated. Thanks! > > Phil Hi Phil - Have you tried DumpSec (http://www.somarsoft.com/)? I've used it in the past to get true last logon info, and it seems to work pretty good. HTH, Derek http://www.fortypoundhead.com
Guest Phil McNeill Posted February 11, 2008 Posted February 11, 2008 Re: Determining When a Domain Account Was Last Used "Phil McNeill" <philmcneill@REMOVETEXTINCAPShydroottawa.com> wrote in message news:euSzfhoaIHA.1376@TK2MSFTNGP02.phx.gbl... >I know how to determine the last time a W2K3 domain account was used to >logon to the domain, but how would I go about determining the last time a >domain account was used for a purpose other than an interactive logon? For >example, to start a Windows service on a member server, or to run a >scheduled task in the Windows Task Scheduler. > > Basically, I'm performing a cleanup of domain accounts and trying to > determine what's actually being used and what's not being used. It's easy > with user accounts, but a little more challenging with accounts that > aren't used for interactive logons. We're in an environment with several > domain controllers and many member servers. > > Any suggestions appreciated. Thanks! > > Phil > Thanks for the suggestions guys. Unfortuantely, everything is geared towards determining the last interactive login, which is pretty much as I expected. Looks like it will be a server by server thing to track down what is and what is not being used. Thanks again!
Recommended Posts