How To Determine from Which Computer a User Logged On

• Windows NT Auditing
  
  -or-
• Microsoft Network Monitor (or other network tracing utility)
  
  -or-
• Using the Windows Internet Naming Service (WINS) database
  
  -or-
• Using the NetBIOS Remote Name Cache table

Back to the top | Give Feedback

Windows NT Auditing

1. Start User Manager for Domains.
2. Click Audit from the Policies menu.
3. Click to enable Success for the Logon and Logoff category. Optionally, you may also select the Failure check box.

   Date:     10/13/97  Event ID:  528
   Time:     10:32:11 AM  Source:  Security
   User:     JoeSmith  Type:  Success Audit
   Computer: MKTINGDOM  Category: Logon/Logoff

   Description:
   Logon/Logoff: Successful
   Logon User Name: JoeSmith
   Domain: MKTINGDOM
   Logon ID: (0x0, 0x2D0D0)
   Logon Type: 3
   Logon Process: User32 Authentication Pkg:
      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
   Workstation Name: \\WKS2
				

Network Monitor

1. Capture all incoming traffic to the domain controller(s). In order to reduce the size of the captured data:
   
   
   • If possible, include only the Primary or Backup Domain Controller that is most likely to validate the intruder.
   • Set a capture filter, including only the server message block (SMB) protocol.
   • Configure a large enough memory buffer through the Buffer Settings option in the Capture menu.
2. After the data has been captured, set a display filter to only include:
   
   Protocol: SMB
   Property: Account Name
   Relation: Exists

Src Mac Addr: Dst Mac Addr: Description
WKS1          SUNKING       C session setup & X, Username = MariaH, and C
tree connect & X, Share = \\SUNKING\IPC$
WKS2          SUNKING       C session setup & X, Username = JoeSmith, and C
tree connect & X, Share = \\SUNKING\IPC$
WKS3          SUNKING       C session setup & X, Username = Administrator,
and C tree connect & X, Share = \\SUNKING\IPC$

Using the WINS Database

1. Start WINS Manager.
2. Click Show Database on the Mappings menu.
3. Click Set Filter, type the user account name in the Computer Name criteria, and then click OK.
4. In the Mappings list, the entry with the user account name and the 03h identifier maps to the IP address of the workstation from which the user logged on to the domain.

Using the NetBIOS Remote Name Table

1. From an MS-DOS command prompt, type the following, and then press Enter.
   
   net send <user name> "text message"
   
   where <user name> is the user account for the user you are attempting to locate.
2. Type the following, and then press Enter.
   
   nbtstat -c
3. As in the example above using the WINS Database, locate the user name that is associated with the 03h identifier and the corresponding IP address is that of the workstation.

Back to the top | Give Feedback