RE: [ActiveDir] How to Determine Who Has Authenticated Against DC

[Noah Eiger]

Oh yes, obvious like that. ;-)   Thanks.   -- nme   From: Darren Mar-Elia [mailto:[EMAIL PROTECTED] Sent: Tuesday, May 16, 2006 9:39 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] How to Determine Who Has Authenticated Against DC   Noah- Yes, any authentications to a DC are logged in the security event log (assuming Logon auditing is enabled). User logons should show up as 528 events.   Darren   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Noah Eiger Sent: Tuesday, May 16, 2006 7:30 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] How to Determine Who Has Authenticated Against DC Hello:   Sorry for what might be an obvious question: Is it possible to determine who has authenticated against a particular DC over a period of time? (And if so how?) I suspect that some machines in one site are authenticating against a DC in another. Without checking each workstation, how can I see where they are authenticating?   Thanks.   -- nme   P.S. Not sure if it is related, but the DC in question reports that it can’t provide some time service to machines in the remote site. (Sorry, not looking at the exact warning message right now.)   -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.392 / Virus Database: 268.5.6/340 - Release Date: 5/15/2006 -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.392 / Virus Database: 268.5.6/340 - Release Date: 5/15/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.392 / Virus Database: 268.6.0/341 - Release Date: 5/16/2006