Remotely Determine Logon Server

[poohsan]

Wanted to revise an old thread: I was needing to determine how to determine what logonserver a remote user used, some folks had suggested using nltest - unfortunately I had a user whose PC connected to a DC in one site and the user authenticated to a DC in a different site. So, I hammered out this vbscript and thought I'd share just in case anyone else still needs the ability

strUser = "Joe.User"
strComputer = "Joe.PC"
strValueName = "LOGONSERVER"
Const HKEY_USERS = &H80000003

Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2")
Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_UserAccount Where Name='" & strUser & "'",,48)
For Each objItem In colItems
strSID = objItem.SID
Next

strKeyPath = strSID & "\Volatile Environment\"

Set objReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
objReg.GetStringValue HKEY_USERS, strKeyPath, strValueName, strLogonServer

WScript.Echo strLogonServer

 

[itsp1965]

Not sure if it needs to be that complicated. You can use Sysinternals PSEXEC command in the following fashion

c:\pstools\psexec \\$computer cmd.exe /c Echo %LOGONSERVER%

Or am I missing something