RE: Windows 2000 user login

Whoops.... that last line should be:
Notepad.exe whoislogon.txt not .exe :(

Instead of buying something, might you try:

Nbtstat -A 192.168.0.0 -n

Sub your IP address of course.

Now you could write a batch to do all in one shot something like

Nbtstat -A 192.168.0.0 -n > whoislogon.txt
Nbtstat -A 192.168.0.1 -n >> whoislogon.txt
Nbtstat -A 192.168.0.2 -n >> whoislogon.txt
Nbtstat -A 192.168.0.3 -n >> whoislogon.txt
Nbtstat -A 192.168.0.4 -n >> whoislogon.txt

This would list all your IP's and who was logged on them.

Dave  

-----Original Message-----
From: Su Wadlow [mailto:swadlow@utdallas.edu] Sent: Thursday, March 27, 2003 11:26
To: security-basics@securityfocus.com
Subject: Re: Windows 2000 user login

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

--On Wednesday, March 26, 2003 1:16 PM -0500 "Wright, Bill" <bwright@ny.whitecase.com> wrote:

> I have never posted to this board, so hopefully I'm following the

I personally don't know of ways to determine the number or location(s) of workstation(s) a user is logged in to, but here are other issues that could be causing the account lockout on just the one workstation:

• A service that runs in the user's context instead of the SYSTEM context and that occasionally has to communicate with a domain server.
• Specialty software that has to store the user's password and that communicates with a domain server and somehow passes that password to the server.
• If you're using Exchange and the user has the mailbox open in Outlook when he changes his password, Outlook will still touch the Exchange server with the old password (like at mail checks). If the user just locks his workstation and doesn't log out, the account will keep getting locked out.
• Persistant network drive mappings can sometimes retain knowledge of an old password.

-- 
Su Wadlow
swadlow@utdallas.edu
Faculty/Staff Support

-------------------------------------------------------------------
SurfControl E-mail Filter puts the brakes on spam,
viruses and malicious code. Safeguard your business
critical communications. Download a free 30-day trial:
http://www.surfcontrol.com/go/zsfsbl1





-------------------------------------------------------------------
SurfControl E-mail Filter puts the brakes on spam,
viruses and malicious code. Safeguard your business
critical communications. Download a free 30-day trial:
http://www.surfcontrol.com/go/zsfsbl1





-------------------------------------------------------------------
SurfControl E-mail Filter puts the brakes on spam,
viruses and malicious code. Safeguard your business
critical communications. Download a free 30-day trial:
http://www.surfcontrol.com/go/zsfsbl1