How to find out where an domain user account are being used?

Question

How to find out where an domain user account are being used?

Tanmoy Banerjee 36

There is a domain account working as a service account configured many devices (e.g. printer, scanner etc.) & servers. How can we fetch those machine details where this IP is configured?
How to fetch if the account is configured with any GPO and or any other domain services?

1 answer

Your answer

Answer 1

Anonymous

This tool may sort it.
https://learn.microsoft.com/en-us/sysinternals/downloads/psloggedon

--please don't forget to upvote and Accept as answer if the reply is helpful--

Rich Matheisen 47,901 Reputation points

2022-06-07T18:54:37.65+00:00

That tool looks to be Windows-centric. It's looking at the registry on the remote machine and it's using the NetSessionEnum API.

The security logs on the DCs would probably be the place to look for the "where the logon came from" information.
Tanmoy Banerjee 36 Reputation points

2022-06-07T18:54:45.257+00:00

@Anonymous , Thanks for your reply!
I'm looking for something different, what if the user account is configured in Printer or scanner.
I want to query every domain controller for their security log for this specific user account to find out from which devices and or IP adress the logon request are coming.
Or is there any way to find it out from event log collector server.
Rich Matheisen 47,901 Reputation points

2022-06-07T18:59:40.2+00:00

If you collect the right information then, yes, that would be a great place to look.

Depending on what auditing you have enabled the security logs can be quite large, though. But looking at historical data would be less troublesome than trying to examine log files on a lot of DCs.

Share via

How to find out where an domain user account are being used?

1 answer

Your answer