RE: Tracking down a user in a large AD network

Dump your event logs into  a text readable format (DumpEVT works well) and
search for "Security,528" using Text Pad.  At the end of the transaction
line will be the workstation number.  OR since you know the User ID.  Search
on the USER ID and avoid extracting only logon info.  This way you can find
out much more of what the user did.  It is easy to save your results into
xls format for easy searching.

Sonja Robinson, CISA
Network Security Analyst
HIP Health Plans
Office:  212-806-4125
Pager: 8884238615



-----Original Message-----
From: simonis [mailto:[email protected]] 
Sent: Thursday, July 24, 2003 4:42 PM
To: [email protected]
Cc: [email protected]
Subject: Tracking down a user in a large AD network



All,
First, forgive the x-post.  I'm not sure, based on list volume, that 
anyone else is subscribed to the IH list =). I have quite the dilemma on my
hands.  I work on a pretty large AD domain with nearly 100 
domain controllers.  We recently had an OU with about 5000 users 
deleted from the directory.  I know the name of the user, but.... it is a
shared account.  (I know, but with over 100,000 users, these things slip by)

What I need to do is track back to the workstation that was used for the
login, and I haven't had much luck.  I'm focusing on event 673, but I'm not
sure this is the right angle.  Any ideas??

TIA,
-Ds


**********************************************************************
CONFIDENTIALITY NOTICE: This e-mail transmission, including any attachments to it,  may contain confidential information or protected health information subject to privacy regulations such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This transmission is intended only for the use of the recipient(s) named above.  If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in this transmission is STRICTLY PROHIBITED.  If you have received this transmission in error, please immediately notify me by reply e-mail and destroy the original transmission in its entirety without saving it in any manner. 






**********************************************************************