Query for User?

[bdwise]

There is a service account user logged onto many workstations in my
large environment, but I don't know where. Is there a way to query
WINS or the DCs to tell what machines the "user" is on?

 

[Herb Martin]

There is a service account user logged onto many workstations in my
large environment, but I don't know where. Is there a way to query
WINS or the DCs to tell what machines the "user" is on?

Probably not (that way).

You can certainly look in WINS for the USER name registration,
but since this is a UNIQUE name -- it will only show the FIRST
station where the account is logged on.

You could try "Account Logon Auditing" but I won't promise that
it includes the machine name (it didn't used to as I recall.)

You could try disabling the account and see who complains or
what stops working?

 

[William Stacey [MVP]]

nbtstat -s ?

 

[Herb Martin]

nbtstat -s ?

Won't work for "many workstations" since User NetBIOS names
are registered uniquely -- i.e. they can only be registered at one
machine concurrently.