Click here to get back home

Disabled Domain Computer Accounts
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Disabled Domain Computer Accounts Tim Nichols 09-20-2006
Posted by Tim Nichols on September 20, 2006, 4:09 pm
Please log in for more thread options
 We are currently trying to remove old computer accounts from our Active
Directory domain. We used a third party utility to find all of the computer
accounts on the domain that did not have their password changed in 90 days
or more. We then disabled all of these accounts.

What I am curious about is whether there is an event that will be recorded
in our domain controller security logs for any computers that have been
disabled, but may still be logged on (for example, if a user doesn't log off
at the end of the day but instead locks their workstation, they may be able
to unlock it the next day and keep working, in fact this is true because we
have tested it). We want to make sure no one is actually using a computer
that had their account locked out.

So, if we could search our event logs for a specific Event ID pertaining to
the computer being locked out, we could figure out if some of the accounts
we disabled are actually online and just hadn't updated the computer account
password in the normal 30 days for XP and 2000 desktops.

-Tim Nichols
MCP



Posted by Steven L Umbach on September 21, 2006, 1:25 am
Please log in for more thread options
 My guess is about the best you can do is to check for account logon failures
for the computer account in the security logs of the domain controllers. If
someone is using the computer and it is connected to the domain [unlike a
remote user] they should shortly know something is up when they can not
access domain resources from the domain computer and would most likely
contact support department. You could disalbe the computer account of a test
domain computer to see what happens and if it does record account logon
failures for the computer account at startup.

Steve


> We are currently trying to remove old computer accounts from our Active
> Directory domain. We used a third party utility to find all of the
> computer accounts on the domain that did not have their password changed
> in 90 days or more. We then disabled all of these accounts.
>
> What I am curious about is whether there is an event that will be recorded
> in our domain controller security logs for any computers that have been
> disabled, but may still be logged on (for example, if a user doesn't log
> off at the end of the day but instead locks their workstation, they may be
> able to unlock it the next day and keep working, in fact this is true
> because we have tested it). We want to make sure no one is actually using
> a computer that had their account locked out.
>
> So, if we could search our event logs for a specific Event ID pertaining
> to the computer being locked out, we could figure out if some of the
> accounts we disabled are actually online and just hadn't updated the
> computer account password in the normal 30 days for XP and 2000 desktops.
>
> -Tim Nichols
> MCP
>



Posted by Paul Bergson on September 21, 2006, 8:26 am
Please log in for more thread options
Check out oldcmp from joeware.net, this is what exactly you are looking for.

http://joeware.net/win/free/index.htm

--
Paul Bergson
MCT, MCSE, MCSA, Security+, BS CSi
2003, 2000 (Early Achiever), NT

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

> We are currently trying to remove old computer accounts from our Active
> Directory domain. We used a third party utility to find all of the
> computer accounts on the domain that did not have their password changed
> in 90 days or more. We then disabled all of these accounts.
>
> What I am curious about is whether there is an event that will be recorded
> in our domain controller security logs for any computers that have been
> disabled, but may still be logged on (for example, if a user doesn't log
> off at the end of the day but instead locks their workstation, they may be
> able to unlock it the next day and keep working, in fact this is true
> because we have tested it). We want to make sure no one is actually using
> a computer that had their account locked out.
>
> So, if we could search our event logs for a specific Event ID pertaining
> to the computer being locked out, we could figure out if some of the
> accounts we disabled are actually online and just hadn't updated the
> computer account password in the normal 30 days for XP and 2000 desktops.
>
> -Tim Nichols
> MCP
>



Posted by Roger Abell [MVP] on September 21, 2006, 10:14 am
Please log in for more thread options
> Check out oldcmp from joeware.net, this is what exactly you are looking
> for.
>
> http://joeware.net/win/free/index.htm
>

Not meaning to discount the value of Joe's utility, but poster
has already located and disabled the computer objects.
The issue is one of event monitoring.

>> We are currently trying to remove old computer accounts from our Active
>> Directory domain. We used a third party utility to find all of the
>> computer accounts on the domain that did not have their password changed
>> in 90 days or more. We then disabled all of these accounts.
>>
>> What I am curious about is whether there is an event that will be
>> recorded in our domain controller security logs for any computers that
>> have been disabled, but may still be logged on (for example, if a user
>> doesn't log off at the end of the day but instead locks their
>> workstation, they may be able to unlock it the next day and keep working,
>> in fact this is true because we have tested it). We want to make sure no
>> one is actually using a computer that had their account locked out.
>>
>> So, if we could search our event logs for a specific Event ID pertaining
>> to the computer being locked out, we could figure out if some of the
>> accounts we disabled are actually online and just hadn't updated the
>> computer account password in the normal 30 days for XP and 2000 desktops.
>>
>> -Tim Nichols
>> MCP
>>
>
>



Posted by Paul Bergson on September 21, 2006, 12:22 pm
Please log in for more thread options
Thanks, I misread.

--
Paul Bergson
MCT, MCSE, MCSA, Security+, BS CSi
2003, 2000 (Early Achiever), NT

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

>> Check out oldcmp from joeware.net, this is what exactly you are looking
>> for.
>>
>> http://joeware.net/win/free/index.htm
>>
>
> Not meaning to discount the value of Joe's utility, but poster
> has already located and disabled the computer objects.
> The issue is one of event monitoring.
>
>>> We are currently trying to remove old computer accounts from our Active
>>> Directory domain. We used a third party utility to find all of the
>>> computer accounts on the domain that did not have their password changed
>>> in 90 days or more. We then disabled all of these accounts.
>>>
>>> What I am curious about is whether there is an event that will be
>>> recorded in our domain controller security logs for any computers that
>>> have been disabled, but may still be logged on (for example, if a user
>>> doesn't log off at the end of the day but instead locks their
>>> workstation, they may be able to unlock it the next day and keep
>>> working, in fact this is true because we have tested it). We want to
>>> make sure no one is actually using a computer that had their account
>>> locked out.
>>>
>>> So, if we could search our event logs for a specific Event ID pertaining
>>> to the computer being locked out, we could figure out if some of the
>>> accounts we disabled are actually online and just hadn't updated the
>>> computer account password in the normal 30 days for XP and 2000
>>> desktops.
>>>
>>> -Tim Nichols
>>> MCP
>>>
>>
>>
>
>



Similar ThreadsPosted
PCs still function on domain with computer account disabled June 14, 2006, 3:51 pm
Local Accounts vs Domain Accounts April 14, 2006, 3:48 pm
Domain authenticating non-domain accounts February 22, 2008, 9:14 am
Domain user accounts migration August 1, 2005, 1:16 pm
IEEE 802.1x authentication for domain user accounts only May 21, 2007, 2:30 pm
[Win2003Server] Lost local accounts on domain controler October 17, 2005, 9:39 am
Granting domain accounts access to a workgroup resource September 8, 2006, 12:13 am
domain access control for local user of domain computer? April 3, 2008, 5:14 pm
Non-Domain computer access September 6, 2005, 3:47 pm
Problem with Domain Computer account December 18, 2006, 2:46 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap