|
| 1 | +I decided to release another free utility I wrote a while ago. This small command-line utility can be used to find out where Active Directory users are logged on into, and/or to find out who is logged on on specific machines. This should include local users, users that are logged in via RDP, user accounts that are used to run services and scheduled tasks (only when the task is running at that time). I have not fully tested all scenario�s yet, but the first results look quite ok. |
| 2 | + |
| 3 | +You can download the utility from http://www.corelan.be:8800/index.php/my-free-tools/ad-cs/pve-find-ad-user/. You need .Net framework 2.0 on the machine that you are running the tool off, and you also need to have admin access on the computers you are running the utility against. |
| 4 | + |
| 5 | +The tool is compiled on a 32bit system, but it should run fine on 64bit systems as well. |
| 6 | + |
| 7 | +Open a command prompt and start the utility without parameters : |
| 8 | + |
| 9 | +---------------------------------------- |
| 10 | + PVE Find AD Users |
| 11 | + Peter Van Eeckhoutte |
| 12 | + (c) 2009 - http://www.corelan.be:8800 |
| 13 | + Version : x.x.x.x |
| 14 | + ----------------------------------------- |
| 15 | + |
| 16 | + Syntax : pveFindADUser.exe <parameters> |
| 17 | + |
| 18 | + Valid parameters are : |
| 19 | + -h |
| 20 | + show help |
| 21 | + -u |
| 22 | + check for updates |
| 23 | + -v |
| 24 | + show a little bit more info (verbose) |
| 25 | + -current ["username"] |
| 26 | + The -current parameters shows the currently logged on user on each PC |
| 27 | + in the domain. If you specify a username (between quotes), then only |
| 28 | + the PC's where that specific user is logged on will be displayed. |
| 29 | + If you don't specify a username, all PC's with logged on users will be |
| 30 | + displayed in the report. |
| 31 | + -last ["username"] |
| 32 | + The -last parameters shows the last logged on user on each PC in the domain. |
| 33 | + If you specify a username (between quotes), then only the PC's where that |
| 34 | + user has logged on last time will be shown |
| 35 | + If you don't specify a username, all PC's with the last logged |
| 36 | + on users will be reported. |
| 37 | + |
| 38 | + In both cases, the username should contain the domain name ! |
| 39 | + (DOMAIN\username) |
| 40 | + |
| 41 | + If you specify DOMAIN\*username* (with 2 asterisks), then |
| 42 | + all users containing the 'username' string will be displayed |
| 43 | + |
| 44 | + -noping |
| 45 | + Do not ping target computer before trying to enumerate user logons |
| 46 | + -p <nr of pings> |
| 47 | + If ping is enabled, set number of pings for verifying that host is alive |
| 48 | + If -p is not specified, 2 pings will be sent |
| 49 | + -rootpath rootpath |
| 50 | + Where rootpath is written in distinguishedName notation |
| 51 | + Example : OU=Computers,dc=domain,dc=com |
| 52 | + -target hostname.domain.com,hostname2.domain.com,hostname3.domain.com |
| 53 | + Optional parameter that allows you to specify the list of hosts |
| 54 | + (fqdn) to run the query against |
| 55 | + Without this -target parameter, queries will be executed against |
| 56 | + all hosts in the current domain |
| 57 | + -stopfound |
| 58 | + Stop searching when first match has been found. |
| 59 | + This parameter works only when looking for currently logged on users |
| 60 | + |
| 61 | + Output will be written to console and to a file called report.csv |
| 62 | + |
| 63 | +While most options are self-explanatory, I�ll go through them anyway : |
| 64 | + |
| 65 | +-h : show help. Not much to say about that. |
| 66 | + |
| 67 | +-u : check if there is an updated version of the utility. You can use this parameter in conjunction with other parameters |
| 68 | + |
| 69 | +-current [�username�] : This parameter can do 2 things. If you only specify -current then the utility will simply get all currently logged on users on all target machines. If you specify a username (DOMAIN\Username) then only the computers where this user is logged on, will be displayed. The utility will try to get the current logged on users from the registry first. If that fails, it will try to get the users via WMI. When the users are collected via WMI, you may see the user account that you are using the run the utility as a logged on user. This user may not be logged on interactively, it just may show up because you are connecting to the host via WMI. Just be aware of this. |
| 70 | + |
| 71 | +-last [�username�] : This parameter can do 2 things as well. If you only specify -last then the utility will attempt to get the last logged on user on the target computer. If you specify a username ( DOMAIN\Username) then only the computers that have this user account as last logon, will be displayed. Note that, depending on your company policy, the last logon username may be hidden and the tool may not be able to get it. |
| 72 | + |
| 73 | +-noping : this option will prevent the tool from performing a ping (well, in fact, by default the tool does 2 pings) before trying to get the user logon information. |
| 74 | + |
| 75 | +-target : this optional parameter allows you to specify the hosts to query. If you don�t specify this -target parameter, then all hosts in the current domain will be queried. If you decide to specify -target, followed with a comma-separated list of hostnames, make sure to use the FQDN of the target hosts. |
| 76 | + |
| 77 | +In its most simple form, you could just run pveadfinduser.exe -current to show all currently logged on users on all machines (computers, servers, domain controllers, �) in the domain. |
| 78 | + |
| 79 | +The tool will write the output of the queries into a csv file called report.csv. This file will contain the following fields : |
| 80 | + |
| 81 | +computername, username, mode and technique. |
| 82 | + |
| 83 | +Mode can be "current" (for currently logged on users) and "last" (for last logged on users). Technique can be "registry" or "wmi", depending on the technique that was used to gather the information. |
0 commit comments