RE: Tracking down a user in a large AD network

You're right.  It might.  I forgot you were using Active Directory correct
not PDC's?  Very interesting question.  I'll do some more research and get
back to you because I'll have the same issue in about 30 days and I need a
good solution too.

Sonja Robinson, CISA
Network Security Analyst
HIP Health Plans
Office:  212-806-4125
Pager: 8884238615



-----Original Message-----
From: simonis [mailto:[email protected]] 
Sent: Friday, July 25, 2003 10:08 AM
To: [email protected]
Cc: Robinson, Sonja
Subject: Re: Tracking down a user in a large AD network


"Robinson, Sonja" wrote:
> 
> Dump your event logs into  a text readable format (DumpEVT works well) 
> and search for "Security,528" using Text Pad.  At the end of the 
> transaction line will be the workstation number.  OR since you know 
> the User ID.  Search on the USER ID and avoid extracting only logon 
> info.  This way you can find out much more of what the user did.  It 
> is easy to save your results into xls format for easy searching.
> 


This would involve looking at the logs of every machine in the network, no?
I've keyed in on a few suspect machines to look for 528's with 
little success, but like I said, we have 100K users here, and I can't 
really afford, computationally, to extract all their logs.  =(


**********************************************************************
CONFIDENTIALITY NOTICE: This e-mail transmission, including any attachments to it,  may contain confidential information or protected health information subject to privacy regulations such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This transmission is intended only for the use of the recipient(s) named above.  If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in this transmission is STRICTLY PROHIBITED.  If you have received this transmission in error, please immediately notify me by reply e-mail and destroy the original transmission in its entirety without saving it in any manner. 






**********************************************************************