logonserver report

[Guest]

Is there a report that can identify which user’s are logged on to
which Domain controller. There is a tab on the computer properties called Users (logonserver will show there.But some computers show more than one logonserver. Which one is accurate?) I would like
to know if there is a report I can pull the info.
Thanks for the help.

[kstanush]

Re: logonserver report

User's don't generally log onto a domain controller, but rather authenticate against it. The Users tab on the computer properties shows the interactive, service, and batch logons for the computer. The function, which you can research by Googleing it, is NetWkstaUserEnum.

I do not know of any way to get the list of users who authenticated against a particular domain controller. If the DC is acting as a terminal server, then terminal services functions can get you the session info. Hyena has that covered fairly well.

[Guest]

Re: logonserver report

Sorry for the wrong terminology. It should be authentication rather logon to domain.
We prefer to see interactive logons.
WMI Export Template has LogonServer Query which what we want.
"The LogonServer property contains the name of the server to which logon requests are sent. Server names should be preceded by two backslashes (\\). A server name with an asterisk (\\*) indicates that the logon request can be handled by any logon server. A null string indicates that requests are sent to the domain controller.
Example: \\MyServer"
on the report we created logon server shows \\* instead name, although computer properties-users tab shows name of the dc names which authenticates.
I think this can not be done using Exporter Pro.

Any ideas ?
Thanks.

[kstanush]

Re: logonserver report

The Users tab does not use WMI, and Exporter Pro does not use provide for a an export which uses the same function, but if you have a WMI class that provides this information, you can use Exporter Pro to run it against multiple computers. But I could not find the one that you are referencing.

[kstanush]

Re: logonserver report

Since the logins are all interactive, I think just putting the __SERVER system property into the query would give you the 'server' that the query is being run on.