acconts being locked

[lumpy04]

HI,
I support a development environment wherre the users access multiple pc's
through VPN, Remote Desktop, PC Anywhere, etc. I believe that user's accounts
are being locked up because they fail to log off every pc they have logged
into, and their passwords become unsynchronized. Has anyone else seen this
problem?

Also, does anyone know of any utility I can use to find out which pc's users
are logged into on the network?

 

[jwgoerlich@gmail.com]

I see this happen all the time. For Windows 2000 and 2003 servers, you
can check the logged on users with Terminal Services Manager. For
Windows XP workstations, you can use the following script:

Name = "YourComputerNameHere"
set WmiObject = GetObject("winmgmts:\\" & Name & "\root\cimv2")
set Computer = WmiObject.get("win32_computersystem.name='" & Name &
"'")
MsgBox _
"Person: " & Computer.UserName & Vbcrlf & _
"Computer: " & Name & Vbcrlf & _
"Time checked: " & Now

I often will wrap this simple script up in one that first enumerates
all of the Windows workstations in a given domain, then checks all the
workstations, and writes this out to a .csv file. If you are
interested, let me know and I will post the entire script up for you.

Hope this helps,

J Wolfgang Goerlich


On Sep 18, 3:42 pm, lumpy04 <lump...@discussions.microsoft.com> wrote:
> HI,
> I support a development environment wherre the users access multiple pc's
> through VPN, Remote Desktop, PC Anywhere, etc. I believe that user's accounts
> are being locked up because they fail to log off every pc they have logged
> into, and their passwords become unsynchronized. Has anyone else seen this
> problem?
>
> Also, does anyone know of any utility I can use to find out which pc's users
> are logged into on the network?

 

[S. Pidgorny]

Interesting approach.

What I do is using eventcombmt.exe to search for event 644 on the PDC
emulator to identify computer that gets account locked.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

<jwgoerlich@gmail.com> wrote in message
news:1190151571.417779.70060@22g2000hsm.googlegroups.com...
>I see this happen all the time. For Windows 2000 and 2003 servers, you
> can check the logged on users with Terminal Services Manager. For
> Windows XP workstations, you can use the following script:
>
> Name = "YourComputerNameHere"
> set WmiObject = GetObject("winmgmts:\\" & Name & "\root\cimv2")
> set Computer = WmiObject.get("win32_computersystem.name='" & Name &
> "'")
> MsgBox _
> "Person: " & Computer.UserName & Vbcrlf & _
> "Computer: " & Name & Vbcrlf & _
> "Time checked: " & Now
>
> I often will wrap this simple script up in one that first enumerates
> all of the Windows workstations in a given domain, then checks all the
> workstations, and writes this out to a .csv file. If you are
> interested, let me know and I will post the entire script up for you.
>
> Hope this helps,
>
> J Wolfgang Goerlich
>
>
> On Sep 18, 3:42 pm, lumpy04 <lump...@discussions.microsoft.com> wrote:
>> HI,
>> I support a development environment wherre the users access multiple pc's
>> through VPN, Remote Desktop, PC Anywhere, etc. I believe that user's
>> accounts
>> are being locked up because they fail to log off every pc they have
>> logged
>> into, and their passwords become unsynchronized. Has anyone else seen
>> this
>> problem?
>>
>> Also, does anyone know of any utility I can use to find out which pc's
>> users
>> are logged into on the network?
>
>

 

[jwgoerlich@gmail.com]

Good point, Svyatoslav. The above script will determine who is logged
onto which computer. Yet inspecting the event log is a better way to
determine what machines are locking which accounts.

Thank you,

J Wolfgang Goerlich


On Sep 19, 4:49 am, "S. Pidgorny <MVP>" <slavi...@yahoo.com> wrote:
> Interesting approach.
>
> What I do is using eventcombmt.exe to search for event 644 on the PDC
> emulator to identify computer that gets account locked.
>
> --
> Svyatoslav Pidgorny, MS MVP - Security, MCSE
> -= F1 is the key =-
>
> *http://sl.mvps.org*http://msmvps.com/blogs/sp*