I know how to determine the last time a W2K3 domain account was used to
logon to the domain, but how would I go about determining the last time a
domain account was used for a purpose other than an interactive logon? For
example, to start a Windows service on a member server, or to run a
scheduled task in the Windows Task Scheduler.

Basically, I'm performing a cleanup of domain accounts and trying to
determine what's actually being used and what's not being used. It's easy
with user accounts, but a little more challenging with accounts that aren't
used for interactive logons. We're in an environment with several domain
controllers and many member servers.

Any suggestions appreciated. Thanks!

Phil

"Phil McNeill" wrote:

> I know how to determine the last time a W2K3 domain account was used to
> logon to the domain, but how would I go about determining the last time a
> domain account was used for a purpose other than an interactive logon? For
> example, to start a Windows service on a member server, or to run a
> scheduled task in the Windows Task Scheduler.
>
> Basically, I'm performing a cleanup of domain accounts and trying to
> determine what's actually being used and what's not being used. It's easy
> with user accounts, but a little more challenging with accounts that aren't
> used for interactive logons. We're in an environment with several domain
> controllers and many member servers.
>
> Any suggestions appreciated. Thanks!
>
> Phil
>
>
>

This article in TechNet may :

http://www.microsoft.com/technet/tec...y/default.aspx

For user accounts wouldn't it be easier to set account password expiration,
then trawl the domain accounts for any that the password is 'stale'?

As for find accounts that run services and scheduled tasks an individual
audit per server? Several scripts could return information.

--
Steve G.
MCSA 2003 +M


"Phil McNeill" wrote:

> I know how to determine the last time a W2K3 domain account was used to
> logon to the domain, but how would I go about determining the last time a
> domain account was used for a purpose other than an interactive logon? For
> example, to start a Windows service on a member server, or to run a
> scheduled task in the Windows Task Scheduler.
>
> Basically, I'm performing a cleanup of domain accounts and trying to
> determine what's actually being used and what's not being used. It's easy
> with user accounts, but a little more challenging with accounts that aren't
> used for interactive logons. We're in an environment with several domain
> controllers and many member servers.
>
> Any suggestions appreciated. Thanks!
>
> Phil
>
>
>

On Feb 8, 11:25 am, "Phil McNeill"
<philmcne...@REMOVETEXTINCAPShydroottawa.com> wrote:
> I know how to determine the last time a W2K3 domain account was used to
> logon to the domain, but how would I go about determining the last time a
> domain account was used for a purpose other than an interactive logon? For
> example, to start a Windows service on a member server, or to run a
> scheduled task in the Windows Task Scheduler.
>
> Basically, I'm performing a cleanup of domain accounts and trying to
> determine what's actually being used and what's not being used. It's easy
> with user accounts, but a little more challenging with accounts that aren't
> used for interactive logons. We're in an environment with several domain
> controllers and many member servers.
>
> Any suggestions appreciated. Thanks!
>
> Phil

Hi Phil -

Have you tried DumpSec (http://www.somarsoft.com/)? I've used it in
the past to get true last logon info, and it seems to work pretty
good.

HTH,
Derek
http://www.fortypoundhead.com

"Phil McNeill" <philmcneill@REMOVETEXTINCAPShydroottawa.com> wrote in
message news:euSzfhoaIHA.1376@TK2MSFTNGP02.phx.gbl...
>I know how to determine the last time a W2K3 domain account was used to
>logon to the domain, but how would I go about determining the last time a
>domain account was used for a purpose other than an interactive logon? For
>example, to start a Windows service on a member server, or to run a
>scheduled task in the Windows Task Scheduler.
>
> Basically, I'm performing a cleanup of domain accounts and trying to
> determine what's actually being used and what's not being used. It's easy
> with user accounts, but a little more challenging with accounts that
> aren't used for interactive logons. We're in an environment with several
> domain controllers and many member servers.
>
> Any suggestions appreciated. Thanks!
>
> Phil
>

Thanks for the suggestions guys. Unfortuantely, everything is geared
towards determining the last interactive login, which is pretty much as I
expected. Looks like it will be a server by server thing to track down what
is and what is not being used.

Thanks again!