Which DC is authenticating?

[TheMisio]

Hello,

Is there any way I can check which DC is processing log requests? I need to be able to do it from a Domain Controller, not the client (which is easy). I've got a remote site, and I do not have access to the client machines (only DC). I have introduced a new DC to the site, and moved (logically) the old server to a different AD site. Now I want to check if the new DC is authenticating within that site. Where can I check that on the DC?

It's a Windows 2003 Domain Controller.

Regards,

 

[58sniper]

All DCs process login requests, generally. What does the security log say?

Pat Richard
Microsoft Exchange MVP
Contributing author The Complete Reference: Microsoft Exchange Server 2007

 

[GrimR]

closest thing I think of is 'net session'OR logonsessions by sysinternals

http://technet.microsoft.com/en-us/sysinternals/bb896769.aspx

 

[Roadki11]

Could do it with a logon script. Have it echo out to a log file the date, time, username, and logonserver.

just a thought.



RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen

 

[itsp1965]

If you go start->run and type %logonserver% it'll open the SYSVOL volume for the server u are authenticating to

 

[58sniper]

running
echo %logonserver%
or
set
will show you the logonserver, but that's assuming you're running from the client side, which isn't available here.

If you're auditing correctly, you should see it in the security event log.

Pat Richard
Microsoft Exchange MVP
Contributing author The Complete Reference: Microsoft Exchange Server 2007

 

[efector]

even easier. type: set l

at a dos prompt.

 

[PScottC]

You have to enable auditing of logon and logoff events. Then the security log will show who is using that server for authentication.

Enable auditing by modifying the Default Domain Controllers Policy GPO.

The most common reason for authentication requests to go across the WAN is that IP subnets have not been assigned to sites in AD Sites and Services.

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers

 

[TheMisio]

Yeah. I’ll enable log on events auditing.
It seems this is the best way to achieve that.

Thank you all for help.

Michael