Workstation last logon to domain

[Guest]

How can you get Hyena to tell the last time a workstation logged onto the domain, similar to the way it does for users?
This is an NT domain with W2K workstations.

TIA,

Pat

[This message has been edited by Pat (edited 01-15-2004).]

[This message has been edited by Pat (edited 01-15-2004).]

[kstanush]

Re: Workstation last logon to domain

I'm not sure that you can and I don't know if this is tracked by Windows. If this is an Active Directory domain, you might see if there is a lastlogon attribute set for the workstation in AD.

[cmccullough]

Re: Workstation last logon to domain

Are you trying to determine which computers are no longer in use?

[Guest]

Re: Workstation last logon to domain

Yes, I am trying to clean up our list of workstations.

[cmccullough]

Re: Workstation last logon to domain

Computers will periodically change the password used in communicating with the PDC of the domain.

Your computer accounts are listed under the Domain Users group as computer$. You have to expand the Global Groups option, then the Domain Users object under there shows you these accounts. Right-click on it, then choose View All User Details. This will display all users and computer accounts along with all of their properties, including Password Age in the right window.

You can filter this list to only show you computer accounts after they are displayed in the right window. Go to Edit->Find/Filter, type in $ for the search string, and for column choose UserName. Check the box to Filter out records that DO NOT match the search string and click OK.

This will leave you with only the computer accounts and you can sort by password age by clicking on the field header for password age. Password age is relevant because computers will change their password with the domain periodically, I believe the default might be around 7-10 days.

So, any accounts that have a large number of days since last change will be suspect.

[Guest]

Re: Workstation last logon to domain

Your steps were accurate, the only problem I ran into is that my Hyena shows 'Users' not 'Domain Users' and with I filter on '$' I get 'No records found matching filter specification'.
Is there a way to add 'Domain Users' to list of catergories like 'Computers' and 'Global Groups'?

Thanks again for your time and effort. I am using Hyena v5.5, rev 'B'

[cmccullough]

Re: Workstation last logon to domain

Expand the Global Groups option, then the Domain Users group under there shows you these accounts.

[Guest]

Re: Workstation last logon to domain

Thanks, you ARE the Man!
Works like a champ.

[Guest]

Re: Workstation last logon to domain

One more follow-on question.
For the computer, it shows a 'User Name' and Full Name' I am assuming that one is the original name, and the other is the current name. If I am correct, which is the current name and would both (or which) names show in Server Manager?
I am unable do delete straight from this screen so I am trying to blast the correct accounts.

Thanks again,

Pat

[cmccullough]

Re: Workstation last logon to domain

I'm not sure but would assume UserName is the one you'll see in Server Manager.

[Guest]

Re: Workstation last logon to domain

How do I do this in 5.7c?

I get different submenus from global groups > Domain users

I need to clean out the computer names that are no longer in use.

[cmccullough]

Re: Workstation last logon to domain

In a Windows NT domain, it will be the same way. If you are in a Windows 2000 domain, you'll right-click on the Computers object beneath your domain and choose Tabular Views->Computer (Detailed). When that displays, the column you want is Pwd Last Set.

[Guest]

Re: Workstation last logon to domain

Hi,
I try the procedure as you described for 6.0B. But, I don't have the option to view the "Password Changed" in the right windows?

Am I missing something?

[cmccullough]

Re: Workstation last logon to domain

Pwd Last Set is the field you need to look for if this is a Windows 2000 domain. Read this entire topic and you will see there is a difference in how you get this data in a Windows NT domain versus a Windows 2000 domain.