I have both of the Roth books, but I've come up empty.
I have a need to determine which client machine a given user (or all
users) has logged into the domain from.
I'm willing to back into it by starting with all client machines. I'm
willing to process all of the machines and users in the domain
To the best of my knowledge (I'd love to be wrong here), this
information does not exist.
Best case scenario, you'd have to turn on some audit flags and from
there parse event log information. Also, this would only work from a
point in time.
We chose to leverage a logon script with a sub routine
Well, for starters...
The information is in your eventlogs on ALL the domain controllers
(collectively).
So, WMI and the Win32_Eventlog class is a good place to start (via
Win32::OLE).
http://www.manross.net/download.aspx?file=/perl/scripts/wmi-generic.pl
C:\perl\scriptsperl wmi-Generic.pl
perl-win32-users-boun...@listserv.activestate.com wrote on 06/04/2012
03:00:03 PM:
I have a need to determine which client machine a given user (or all
users) has logged into the domain from.
I'm willing to back into it by starting with all client machines. I'm
If you can access via WMI,
Thank you for the detailed response, even if it is depressing.
Barry Brevik
On the other hand, if you are really asking the question from,
you have to go to the event logs; there, you can get if a login
was local or via the network. The problem, of course, is that it
is very transitory; on
