How do I find what computers a user is logged into?

[steve813]

How do I find what computers a user is logged into? I work in a domain
with over 80,000 users, with an equal number of computer objects, and
over 30 DC's and we get users that log themselves into a computer and
forget to logout of the computer. The next day they go to another
computer and logon and change the password for the account. Since they
did not logout of the first computer their user ID gets locked out.
So, my question is how do I find the computer they forgot to logout of?
Or, is there a tool like the old Banyan Vines "mlogout.exe" (wow,
I just dated myself with that one) for the MS world to forcefully log
the user out of any computer they are on?

Thanks,
Steve

 

[Torgeir Bakken \(MVP\)]

How do I find what computers a user is logged into? I work in a domain
with over 80,000 users, with an equal number of computer objects, and
over 30 DC's and we get users that log themselves into a computer and
forget to logout of the computer. The next day they go to another
computer and logon and change the password for the account. Since they
did not logout of the first computer their user ID gets locked out.
So, my question is how do I find the computer they forgot to logout of?
Or, is there a tool like the old Banyan Vines "mlogout.exe" (wow,
I just dated myself with that one) for the MS world to forcefully log
the user out of any computer they are on?

Hi

Nothing builtin that can help you here I'm afraid, but it looks like
Microsoft is going to release something this year that supports this.

Coming from Microsoft is a product called LimitLogin (still in beta):
http://bink.nu/?ArticleID=1452

 

[Matt Gibson]

Actually, it's been released

It'll do exactly what he wants.

Here's my early look at it.

http://www.thepersonunderthestairs.com/?p=23

Matt Gibson - GSEC

 

[Steven L Umbach]

If you have auditing of account logon events enable in Domain Controller
Security Policy you might try searching the domain controller security logs
for the user name to find account logon events for success and failure and
you just may come up with the computer names. Event Comb can speed up that
process by scanning all the domain controller security logs for you.
netlogon logging should also show the information but that would be a pretty
large task in that large of a domain. SysInternals has a free tool called
PsLoggedOn that also may be worth a look at. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;308471 --- Event
Comb
http://www.microsoft.com/downloads/...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en
-- where to get Event Comb and an a white paper on acount lockout problems
and how to use netlogon logging.
http://www.sysinternals.com/ntw2k/freeware/psloggedon.shtml -- psloggedon

 

[Torgeir Bakken \(MVP\)]

Actually, it's been released

It'll do exactly what he wants.

Here's my early look at it.

http://www.thepersonunderthestairs.com/?p=23

Hi

Great

Here is another article with more information, and it have a
FAQ link as well.

http://www.thincomputing.net/newsitem296.html

 

[steve813]

Ahh, thanks! You got me on the right trail.

Check out
http://www.microsoft.com/downloads/...1d-cd55-4829-a189-99515b0e90f7&DisplayLang=en

 

[Jerold Schulman]

How do I find what computers a user is logged into? I work in a domain
with over 80,000 users, with an equal number of computer objects, and
over 30 DC's and we get users that log themselves into a computer and
forget to logout of the computer. The next day they go to another
computer and logon and change the password for the account. Since they
did not logout of the first computer their user ID gets locked out.
So, my question is how do I find the computer they forgot to logout of?
Or, is there a tool like the old Banyan Vines "mlogout.exe" (wow,
I just dated myself with that one) for the MS world to forcefully log
the user out of any computer they are on?

Thanks,
Steve

In addition to LimitLogon V1.0, you might find tip 8768 in the 'Tips & Tricks' at http://www.jsiinc.com simpler.


Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com

 

[Cristian Martinez Casado]

Hi Steve

You can use WMI, too. If check the properties of the Win32.Computer Class, there is a property named "user"or something like that.

If you query the pc for this specific property, it will give you the logged-in user.

Before you deal with WMI, you have to download the SDK from microsoft.

Regards,

Cristian Martinez Casado

 

[Torgeir Bakken \(MVP\)]

Hi Steve

You can use WMI, too. If check the properties of the
Win32.Computer Class, there is a property named "user"or something
like that.

If you query the pc for this specific property, it will give you
the logged-in user.

Before you deal with WMI, you have to download the SDK from microsoft.

Hi

Note that many have reported (in the newsgroups) that this property
will be retuned as empty unless the user on the remote computer have
local admin rights....

 

[steve813]

I want to thank everyone for their help. The use of LockoutStatus.exe
has helped us out alot.