IT Question - SV650.org

Skip · 24-02-07, 09:19 AM

Does anyone know if an NT4 or AD domain controller keeps a log of what machines logged onto the network? We have misplaced a laptop and my boss is asking me if it connected to the network. AFAIK there is no way to tell, but someone please feel free to prove me wrong.

Cheers in advance!

rictus01 · 24-02-07, 10:18 AM

Do you catalog you IT mac addresses ? as this is the unique identifier you can track it's location through layer two network devices.

Cheers Mark.

Skip · 24-02-07, 10:25 AM

Unfortunately no - I think I already know the answer to my own question!

24-02-07, 10:40 AM

Just throwing this out, probably totally off, but DHCP logs? not sure how much help it would be.

Skip · 24-02-07, 11:01 AM

Quote:

Originally Posted by rigor

Just throwing this out, probably totally off, but DHCP logs? not sure how much help it would be.

Tell me where to look!

I did think of that, trouble is its been logged onto an NT4 domain and I am not sure if its going to tell me enough

24-02-07, 01:54 PM

Ok does your network use machine names where you can distinguish between a desktop PC or a laptop? eg where I work all workstations have a bar code and their "name" is w{barcode no}.

So I can look in server manager and see all the workstations connected to our PDC. Its usually a list like w303077, w345632, etc

Maybe that may be a way to track it down. Because you can see machines connected and it also gives you the user login used on that machine. If you have a fairly small network if you can tie all logins up to a machine you know about then you have your answer.

TSM · 25-02-07, 11:03 AM

You can allways do a netstat from the command line to find all active connections to the server.

As lynw said, in the CP under Server Manager will allow you to see all connected computers and what files they are accessing etc..

Under windows 2000/2003 server you can try Computer Manager and look in Shared Folders for a list of connections to shares.

Skip · 26-02-07, 08:44 AM

Cheers guys, tried all that and it shows no evidence that it is currently connected so I have bit the bullet and told them that it hasnt been - out of my hands now!

26-02-07, 10:17 AM

under NT you can use svrmanager to find out what machines are currently connected to your DC

27-02-07, 03:51 PM

Sorry if this is a bit late, but you can look in the security logs under event viewer. *IF* you were auditing logons then the computername where the logon took place from will be recorded. If you were not auditing that information then there's no way to tell for sure...

24-02-07, 09:19 AM	#1
Skip Member Mega Poster Join Date: Feb 2005 Location: Norfolk Posts: 3,151	IT Question Does anyone know if an NT4 or AD domain controller keeps a log of what machines logged onto the network? We have misplaced a laptop and my boss is asking me if it connected to the network. AFAIK there is no way to tell, but someone please feel free to prove me wrong. Cheers in advance! __________________ '81 Honda H100A '18 Honda MSX125 (Grom)

24-02-07, 10:18 AM	#2
rictus01 Member Mega Poster Join Date: Jul 2003 Location: South London Posts: 9,799	Re: IT Question Do you catalog you IT mac addresses ? as this is the unique identifier you can track it's location through layer two network devices. Cheers Mark. __________________ Life should not be a journey to the grave with the intention of arriving safely in a pretty and well preserved body, but rather to skid in broadside, in a cloud of smoke, thoroughly used up, totally worn out, and loudly proclaiming, 'Wow! What a Ride!

24-02-07, 10:25 AM	#3
Skip Member Mega Poster Join Date: Feb 2005 Location: Norfolk Posts: 3,151	Re: IT Question Unfortunately no - I think I already know the answer to my own question! __________________ '81 Honda H100A '18 Honda MSX125 (Grom)

24-02-07, 10:40 AM	#4
rigor Guest Posts: n/a	Re: IT Question Just throwing this out, probably totally off, but DHCP logs? not sure how much help it would be.

24-02-07, 01:54 PM	#6
lynw Guest Posts: n/a	Re: IT Question Ok does your network use machine names where you can distinguish between a desktop PC or a laptop? eg where I work all workstations have a bar code and their "name" is w{barcode no}. So I can look in server manager and see all the workstations connected to our PDC. Its usually a list like w303077, w345632, etc Maybe that may be a way to track it down. Because you can see machines connected and it also gives you the user login used on that machine. If you have a fairly small network if you can tie all logins up to a machine you know about then you have your answer.

25-02-07, 11:03 AM	#7
TSM The Sick Man Mega Poster Join Date: Nov 2004 Location: Peckham.SE.LDN Posts: 4,768	Re: IT Question You can allways do a netstat from the command line to find all active connections to the server. As lynw said, in the CP under Server Manager will allow you to see all connected computers and what files they are accessing etc.. Under windows 2000/2003 server you can try Computer Manager and look in Shared Folders for a list of connections to shares. __________________ OTR: KTM 690 Duke R 2015 Full Akro SIDELINE: Kwak ZX636 A1P 2002, Red, R&G's, Yoshi, Double Bubble Screen GONE: Kwak ZX-7R P1, Full Akro, Undertray, Screen GONE: SV650S K2 Very Bruised & Without Fairing, Motovation Frame Sliders, R&G Ally Sprocket Toe Protector, HEL 2 Line Setup, GSXR K1 600 RWU Forks, Barnett Clutch & Springs, Penske 8981 Shock, Gilles Ti Rearsets, Steel Barends, Scottoiler, AFAM Chain & Sprockets, Twin FIAMM Horns, Skidmarx Bellypan, Full Micron Zeta Steel System, Cut down undertay. Forum Problems & Information / Site Suggestions

26-02-07, 08:44 AM	#8
Skip Member Mega Poster Join Date: Feb 2005 Location: Norfolk Posts: 3,151	Re: IT Question Cheers guys, tried all that and it shows no evidence that it is currently connected so I have bit the bullet and told them that it hasnt been - out of my hands now! __________________ '81 Honda H100A '18 Honda MSX125 (Grom)

26-02-07, 10:17 AM	#9
wyntrblue Guest Posts: n/a	Re: IT Question under NT you can use svrmanager to find out what machines are currently connected to your DC

27-02-07, 03:51 PM	#10
Terence Guest Posts: n/a	Re: IT Question Sorry if this is a bit late, but you can look in the security logs under event viewer. IF you were auditing logons then the computername where the logon took place from will be recorded. If you were not auditing that information then there's no way to tell for sure...

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
MOT Question	DanDare	Bikes - Talk & Issues	4	04-03-08 01:48 PM
R&G bar end question	lukemillar	SV Talk, Tuning & Tweaking	1	21-03-06 10:27 AM
Bhp Question	kashby	SV Talk, Tuning & Tweaking	4	07-05-05 11:39 AM
N.I.P. Question?	Cronos	Bikes - Talk & Issues	19	21-04-05 11:21 AM