Article ID: 199472 - View products that this article applies to.
This article was previously published under Q199472
This article describes the methods which are available in Windows NT to identify which workstation was used by a user to log on to the network. You can use one or more of the following methods:
Method 1: Using Windows NT AuditingTo use Windows NT auditing to determine which workstation a user accessed to logon to the domain, follow these steps:
Event Detail Date: 06/04/98 Event ID: 528 Time: 10:06:43 AM Source: Security User: msolanki Type: Success Audit Computer: SMSCENT Category: Logon/Logoff Description: Logon/Logoff: Successful Logon User Name: msolanki Domain: SATHYA Logon ID: (0x0, 0x2D0D0) Logon Type: 3 Logon Process: User32 Authentication Pkg: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: \\JAMES
Method 2: Using Network MonitorTo use Network Monitor to determine which workstation a user accessed to log on to the domain, follow these steps:
In the example above, WKS1 is the computer where the user is logging on from, SUNKING is the domain controller authenticating the request, and the Description contains the Windows NT domain account being used.
Src Mac Addr: Dst Mac Addr: Description WKS1 SUNKING C session setup & X, Username = MariaH, and C tree connect & X, Share = \\SUNKING\IPC$ WKS2 SUNKING C session setup & X, Username = JoeSmith, and C tree connect & X, Share = \\SUNKING\IPC$ WKS3 SUNKING C session setup & X, Username = Administrator, and C tree connect & X, Share = \\SUNKING\IPC$
NOTE: The Src Mac Addr may also been shown as a media access control or IP address if the NetBIOS name could not be resolved or the entry is not in the Network Monitor address database.
Method 3: Using Windows NT Diagnostics
To use Windows NT diagnostics to determine which workstation a user accessed to log on to the domain, follow these steps:
Identifier Value Your Access level Admin; Local Workgroup or Domain SATHYA Network version 4.0 Lan Root SATHYA Logged On Users 1 Current User (1) MSolanki Logged Domain SATHYA Logon Server SMSCENT
Article ID: 199472 - Last Review: October 27, 2006 - Revision: 2.4