Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
peak debt
Mar 11, 2001
b& :(
Nap Ghost
This is the script I use
code:
// Searches the registry for all versions of installed Java runtimes and uninstalls them

// Terminates all running IE instances
killProcesses("iexplore.exe");

var shell = new ActiveXObject("WScript.Shell");
keyPath = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall";
HKLM = 0x80000002;

// Enumerate all the subkeys of the Uninstall registry
oLoc = new ActiveXObject("WbemScripting.SWbemLocator");
oSvc = oLoc.ConnectServer(null, "root\\default");
oReg = oSvc.Get("StdRegProv");
oMethod = oReg.Methods_.Item("EnumKey");
oInParam = oMethod.InParameters.SpawnInstance_();
oInParam.hDefKey = HKLM;
oInParam.sSubKeyName = keyPath;
colItems = oReg.ExecMethod_(oMethod.Name, oInParam);

var x = colItems.sNames.toArray()

for (i=0; i<x.length; i++)
{
	try
	{
		displayName = shell.RegRead("HKLM\\" + keyPath + "\\" + x[i] + "\\DisplayName");

		// Try to find all old Java runtimes no matter how it was called back then
		if (displayName.indexOf("Java(TM) 6 Update") == 0 || 
			displayName.indexOf("Java 2 Runtime Environment") == 0 || 
			displayName.indexOf("J2SE Runtime Environment") == 0 || 
			displayName.indexOf("Java(TM) SE Runtime Environment") == 0
			)
		{
			displayVersion = shell.RegRead("HKLM\\" + keyPath + "\\" + x[i] + "\\DisplayVersion");
			WScript.Echo(displayName);
			WScript.Echo(displayVersion);

			// If this installation is not Java 7, uninstall it
			if (displayName.indexOf("Java(TM) 7"))
			{
				uninstall = shell.RegRead("HKLM\\" + keyPath + "\\" + x[i] + "\\UninstallString");
				uninstallString = uninstall + " /qb";
				WScript.Echo(uninstallString);

				// If the uninstallstring is using /i as an argument we need to replace it with /x
				// MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142100} /qb
				if (uninstallString.toLowerCase().indexOf('/i') != -1)
				{
					uninstallString = uninstallString.replace(/\/i/i, '/x');
					WScript.Echo('=> ' + uninstallString);
				}

				WScript.Echo(shell.Run(uninstallString, 1, true));
			}
		}
	}
	catch (e)
	{
	}
}

function killProcesses(processName)
{
	debug("Trying to kill all instances of " + processName);

	var wmiService = GetObject("winmgmts:\\\\.\\root\\cimv2");
	var colItems = wmiService.ExecQuery("Select * from Win32_Process Where Name = '" + processName + "'", "WQL", 0x30);

	var enumItems = new Enumerator(colItems);
	for (; !enumItems.atEnd(); enumItems.moveNext())
	{
		var objItem = enumItems.item();

		debug("Killing " + processName);
		objItem.terminate();
	}
}

function debug(errorMessage)
{
	if (WScript.FullName.indexOf("cscript") != -1)
		WScript.Echo(errorMessage);
}
It goes through the registry, finds out which Javas are currently installed, and removes all that aren't Java 7 (Java 7 installers properly remove old versions themselves)

Adbot
ADBOT LOVES YOU

Sudden Loud Noise
Feb 18, 2007

FISHMANPET posted:

I'm not sure if that means they kept the same product code or not.

They don't, for every update they get a new product code. It's incredibly maddening and is just more proof that the people handling Java are incompetent.

That may not be entirely fair, but it is easily one of the worst handled products in the mass market.

Matt Zerella
Oct 7, 2002

Norris'es are back baby. It's good again. Awoouu (fox Howl)

peak debt posted:

This is the script I use
code:
// Searches the registry for all versions of installed Java runtimes and uninstalls them

// Terminates all running IE instances
killProcesses("iexplore.exe");

var shell = new ActiveXObject("WScript.Shell");
keyPath = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall";
HKLM = 0x80000002;

// Enumerate all the subkeys of the Uninstall registry
oLoc = new ActiveXObject("WbemScripting.SWbemLocator");
oSvc = oLoc.ConnectServer(null, "root\\default");
oReg = oSvc.Get("StdRegProv");
oMethod = oReg.Methods_.Item("EnumKey");
oInParam = oMethod.InParameters.SpawnInstance_();
oInParam.hDefKey = HKLM;
oInParam.sSubKeyName = keyPath;
colItems = oReg.ExecMethod_(oMethod.Name, oInParam);

var x = colItems.sNames.toArray()

for (i=0; i<x.length; i++)
{
	try
	{
		displayName = shell.RegRead("HKLM\\" + keyPath + "\\" + x[i] + "\\DisplayName");

		// Try to find all old Java runtimes no matter how it was called back then
		if (displayName.indexOf("Java(TM) 6 Update") == 0 || 
			displayName.indexOf("Java 2 Runtime Environment") == 0 || 
			displayName.indexOf("J2SE Runtime Environment") == 0 || 
			displayName.indexOf("Java(TM) SE Runtime Environment") == 0
			)
		{
			displayVersion = shell.RegRead("HKLM\\" + keyPath + "\\" + x[i] + "\\DisplayVersion");
			WScript.Echo(displayName);
			WScript.Echo(displayVersion);

			// If this installation is not Java 7, uninstall it
			if (displayName.indexOf("Java(TM) 7"))
			{
				uninstall = shell.RegRead("HKLM\\" + keyPath + "\\" + x[i] + "\\UninstallString");
				uninstallString = uninstall + " /qb";
				WScript.Echo(uninstallString);

				// If the uninstallstring is using /i as an argument we need to replace it with /x
				// MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142100} /qb
				if (uninstallString.toLowerCase().indexOf('/i') != -1)
				{
					uninstallString = uninstallString.replace(/\/i/i, '/x');
					WScript.Echo('=> ' + uninstallString);
				}

				WScript.Echo(shell.Run(uninstallString, 1, true));
			}
		}
	}
	catch (e)
	{
	}
}

function killProcesses(processName)
{
	debug("Trying to kill all instances of " + processName);

	var wmiService = GetObject("winmgmts:\\\\.\\root\\cimv2");
	var colItems = wmiService.ExecQuery("Select * from Win32_Process Where Name = '" + processName + "'", "WQL", 0x30);

	var enumItems = new Enumerator(colItems);
	for (; !enumItems.atEnd(); enumItems.moveNext())
	{
		var objItem = enumItems.item();

		debug("Killing " + processName);
		objItem.terminate();
	}
}

function debug(errorMessage)
{
	if (WScript.FullName.indexOf("cscript") != -1)
		WScript.Echo(errorMessage);
}
It goes through the registry, finds out which Javas are currently installed, and removes all that aren't Java 7 (Java 7 installers properly remove old versions themselves)

Fannntastic. I'm going to test this out on a few users and see if OCS picks up the software change.

gbeck
Jul 15, 2005
I can RIS that
I am looking for something I can provide to the support staff to be a central place to view information, like which terminal server users are signed into, easy access to reset passwords, or whatever other things I dream up. Basically I can write a script/app and the support staff can run as needed.

I have been looking around but haven't come up with anything. What are other people using to provide easy to use tools for other support staff?

Sudden Loud Noise
Feb 18, 2007

gbeck posted:

I am looking for something I can provide to the support staff to be a central place to view information, like which terminal server users are signed into, easy access to reset passwords, or whatever other things I dream up. Basically I can write a script/app and the support staff can run as needed.

I have been looking around but haven't come up with anything. What are other people using to provide easy to use tools for other support staff?

Does RSAT not provide most of what you want?

Thanks Ants
May 21, 2004

#essereFerrari


I'm looking at ManageEngine at the moment to allow certain staff members to create / reset passwords / disable user accounts in a very specific OU (basically volunteers that they are responsible for). It seems to tick all the boxes for a reasonable price.

gbeck
Jul 15, 2005
I can RIS that

spidoman posted:

Does RSAT not provide most of what you want?

I work in healthcare and the main group of people I am targeting are the "Application Admins". They know everything about the clinical side but just enough on the IT side. I don't really expect (or want) them to be running around AD or give them admin rights to servers.

Sudden Loud Noise
Feb 18, 2007

peak debt posted:

This is the script I use
code:
Awesome Java uninstall script
It goes through the registry, finds out which Javas are currently installed, and removes all that aren't Java 7 (Java 7 installers properly remove old versions themselves)

Not sure if it applies in your environment, but don't forget about 64bit :suicide:

Yaos
Feb 22, 2003

She is a cat of significant gravy.
Changing the name every other day suddenly makes sense, if you can not find it then you can not uninstall it and that means you like it!

So we are going to start moving people over to active directory soon and everybody will be limited users. Any gotchas we should know about? We will be on 2008 with XP and 7 machines. We already have policies, mapped drives, and printers set up. We have a sane structure for the domain instead of things thrown wherever we wanted in eDirectory.

We are going to turn off automatic updates for java, adobe reader and flash so people won't be bugged by it. I am hoping we can push out updates easily through SCCM once we get that up and running.

I was thinking that I should poke around more too see if we can convert local profiles to AD profiles, but then I realized it is time for as much as a fresh start as we can get so screw their probably malware filled profiles.

Also, Novell sucks.

Yaos fucked around with this message at 09:14 on Jan 21, 2013

Thanks Ants
May 21, 2004

#essereFerrari


Try and get rid of XP if you can. The stuff in Vista onwards from a Group Policy perspective is like night and day compared to XP. No more scripting for every tiny little thing.

Yaos
Feb 22, 2003

She is a cat of significant gravy.
We are slowly getting rid of XP, all new machines we put out will be Windows 7 Pro x64. We don't have the money to replace everything though so XP will be with us for awhile.

A co-worker showed me the magic of remote assistance. We've been using TightVNC, but it's kind of slow and has no features in it, probably should have used UltraVNC but I don't care now. We found a hack that let's us connect Windows 7 to XP without solicitation. It's included with Windows so we don't have to spend anything, which is nice. Only problem is the user needs to be logged in, although if we need in we can just RDP in. Once SCCM goes up we'll be using that though. I wish we had the money for 3rd party patch management so I can be lazy.

Cpt.Wacky
Apr 17, 2005
So I've got a problem with printers. Just about everyone has their own personal laser printer in their office. We've been setting them up on wireless so it's more convenient to install in these offices. Then we've got one group policy that pushes out all the printers on the print server to everyone. Now people are starting to complain that they don't like trying to find their own printer out of a list of 30 or more.

I don't see any easy way to assign specific printers to specific people or computers without making a poo poo ton of individual GPOs, and we don't have any sensible grouping like Dept X, Y, and Z or floors 1, 2, and 3. Am I missing something here? (Besides dragging all the printers out into the parking lot and having a big bonfire.)

stevewm
May 10, 2005

Cpt.Wacky posted:

So I've got a problem with printers. Just about everyone has their own personal laser printer in their office. We've been setting them up on wireless so it's more convenient to install in these offices. Then we've got one group policy that pushes out all the printers on the print server to everyone. Now people are starting to complain that they don't like trying to find their own printer out of a list of 30 or more.

I don't see any easy way to assign specific printers to specific people or computers without making a poo poo ton of individual GPOs, and we don't have any sensible grouping like Dept X, Y, and Z or floors 1, 2, and 3. Am I missing something here? (Besides dragging all the printers out into the parking lot and having a big bonfire.)


I ran into something similar 2 years ago... We have a app that runs in terminal services. Said app requires printer names to NEVER change once set. RDP printer re-direction was out since the local printer name changes with every login. So I had to come up with something different...

All the printers that are used for this software are installed locally on the terminal server. So for every user in this situation, I put the name of their default printer into a unused AD field on the user object. (I used the "Office" field, as we don't use it for anything else.) and then wrote a login script in VBS that reads that field, checks that the printer exists, and if it does, sets the user's default printer to it. In our environment, the printer assignments rarely ever change, so managing it is fairly painless.

stevewm fucked around with this message at 03:01 on Jan 29, 2013

Yaos
Feb 22, 2003

She is a cat of significant gravy.

Cpt.Wacky posted:

So I've got a problem with printers. Just about everyone has their own personal laser printer in their office. We've been setting them up on wireless so it's more convenient to install in these offices. Then we've got one group policy that pushes out all the printers on the print server to everyone. Now people are starting to complain that they don't like trying to find their own printer out of a list of 30 or more.

I don't see any easy way to assign specific printers to specific people or computers without making a poo poo ton of individual GPOs, and we don't have any sensible grouping like Dept X, Y, and Z or floors 1, 2, and 3. Am I missing something here? (Besides dragging all the printers out into the parking lot and having a big bonfire.)
If you deny all rights to a printer in 2008 it will not push the printer out to the user as they won't have rights to install the printer. You can either deny all to the everybody group and add permissions per user or per group, or allow all and then deny users and groups.

I don't know if this is easier than setting up GPOs per user/group though.

Guesticles
Dec 21, 2009

I AM CURRENTLY JACKING OFF TO PICTURES OF MUTILATED FEMALE CORPSES, IT'S ALL VERY DEEP AND SOPHISTICATED BUT IT'S JUST TOO FUCKING HIGHBROW FOR YOU NON-MISOGYNISTS TO UNDERSTAND

:siren:P.S. STILL COMPLETELY DEVOID OF MERIT:siren:

Cpt.Wacky posted:

So I've got a problem with printers. Just about everyone has their own personal laser printer in their office. We've been setting them up on wireless so it's more convenient to install in these offices. Then we've got one group policy that pushes out all the printers on the print server to everyone. Now people are starting to complain that they don't like trying to find their own printer out of a list of 30 or more.

I don't see any easy way to assign specific printers to specific people or computers without making a poo poo ton of individual GPOs, and we don't have any sensible grouping like Dept X, Y, and Z or floors 1, 2, and 3. Am I missing something here? (Besides dragging all the printers out into the parking lot and having a big bonfire.)

You can make one GPO to assign the printers, and then use item level targeting, on the Common tab, to restrict the distribution. (User Config -> Preferences -> Control Panel Settings -> Printers)

EAT THE EGGS RICOLA
May 29, 2008

It drives me insane that the solution to this isn't "show everyone how to add the printer they want then wash your hands of it forever".

Master Stur
Jun 13, 2008

chasin' tail

EAT THE EGGS RICOLA posted:

It drives me insane that the solution to this isn't "show everyone how to add the printer they want then wash your hands of it forever".

That's similar to how we do it since our departments/users are so scattered that it doesn't make much sense to force printers through GPO or scripts. So their installed to a print server and we just taught the "leads" in the bigger depts how to do it so they can handle it if a user mucks it up somehow otherwise we just manually put them on new PCs as they're ordered or handle it case by case.

I can't imagine that being an effective solution for a larger more organized place though. Maybe send out an instructional e-mail :haw:

peak debt
Mar 11, 2001
b& :(
Nap Ghost
Back in 2007 or so when working for an office where there were like 40 printers for 150 people I made an HTA script that listed all available printers with their fancy names (taken from an AD property) and added them through WSH when clicked on.

Where I currently work at the official way is to send people asking for help adding printers a one-page PDF telling them how to go to Start->Printers->Add Printer

incoherent
Apr 24, 2004

01010100011010000111001
00110100101101100011011
000110010101110010

gbeck posted:

I work in healthcare and the main group of people I am targeting are the "Application Admins". They know everything about the clinical side but just enough on the IT side. I don't really expect (or want) them to be running around AD or give them admin rights to servers.

Its roll separation and its a core concept of AD. You can install RSAT and not give them the keys to the kingdom. Just enable active directory users and computers, and pair down what the person needs to see or have rights to.

You've already given them password reset rights, now craft an MMC that sits on their desks and allow specific OU view of their purview.

zapateria
Feb 16, 2003

"[oMa posted:

Whackster" post="411401784"]
Just a heads up - although Microsoft haven't announced it yet, SCCM 2012 SP1 RTM is finally available for download on VLSC, and I expect TechNet too. You'll need to install the Windows 8 ADK on your server before upgrading.

Welp, looks like we're gonna have to install SP1 right away, since all our clients are getting corrupted by a Windows patch...


http://support.microsoft.com/kb/2796086

Sacred Cow
Aug 13, 2007

zapateria posted:

Welp, looks like we're gonna have to install SP1 right away, since all our clients are getting corrupted by a Windows patch...


http://support.microsoft.com/kb/2796086

Same thing happened to me a few weeks ago. I did the registry hack they suggested in the KB and everything started working again after reinstalling the Management Point.

peak debt
Mar 11, 2001
b& :(
Nap Ghost

Sacred Cow posted:

Same thing happened to me a few weeks ago. I did the registry hack they suggested in the KB and everything started working again after reinstalling the Management Point.

But it will also disable automatic client reinstallation, so you'll have to do the manual resets again like in 2007 :(

Sacred Cow
Aug 13, 2007

peak debt posted:

But it will also disable automatic client reinstallation, so you'll have to do the manual resets again like in 2007 :(

Crap didn't read that part...I guess I'll be installing SP1 ahead of schedule. Thanks for the heads up.

Sudden Loud Noise
Feb 18, 2007

Little tip for everyone using SCCM 2012 to deploy applications. Never make a mandatory user based install. You'll never get decent compliance numbers.

Ugh, so many little hidden quirks in app models.

Ifan
Feb 21, 2006
The Nice Operator from Heaven

spidoman posted:

We have a 2% threshold for errors in application deployments. We do phased deployments to avoid unforeseen errors.

Phased deployments are awesome, but a lot more work if you don't automate it. My environment is very homogenous, so i can usually do a test-run on one department and then an enterprise wide deployment (if needed).

When it comes to you stastics issue - keep it simple, stupid. In my deployment monitor script I won't send out any alerts before the software has been attempted installed on atleast 50 clients.
Depending on your environment, it won't take many minutes until you hit that anyway. Before hitting that threshold you always want to keep an eye on it before moving to doing something else. Don't waste hours coding stuff like if you have better things to do (hey, a new Java version just shipped!)

Sudden Loud Noise
Feb 18, 2007

Ifan posted:

Phased deployments are awesome, but a lot more work if you don't automate it. My environment is very homogenous, so i can usually do a test-run on one department and then an enterprise wide deployment (if needed).

When it comes to you stastics issue - keep it simple, stupid. In my deployment monitor script I won't send out any alerts before the software has been attempted installed on atleast 50 clients.
Depending on your environment, it won't take many minutes until you hit that anyway. Before hitting that threshold you always want to keep an eye on it before moving to doing something else. Don't waste hours coding stuff like if you have better things to do (hey, a new Java version just shipped!)

We have pre-built phase collections to speed up the process. But it also helps that we aren't the ones who keep track of deployment schedules.

For now I've given up on trying to make the phases more statistically appropriate, our 50k phase probably isn't statistically necessary, but it makes everyone feel safer.

And yeah, Java has taken up most of my time the past couple weeks.

Don't let users open up browser windows during the upgrade process of Java. It messes everything up really bad.

Sudden Loud Noise fucked around with this message at 04:45 on Feb 7, 2013

Ifan
Feb 21, 2006
The Nice Operator from Heaven

spidoman posted:


Don't let users open up browser windows during the upgrade process of Java. It messes everything up really bad.

Yes, yes it does.
Do you count everything as a failure like download failed, user canceled for non mandatory things or just error 1603s etc?

To avoid problems with browsers and Java I made a wrapper script that handles it.
It asks the user to turn off $process because $application needs to be updated. They have 90 minutes to comply, or the browser gets killed. They can postpone the update once (and it will try again in 2 days).
This works pretty well, and the users are pretty happy about it. Not having too many problems with people turning on the browser before it's finished installing.
I'm concidering using a local applocker policy to avoid this in the next version of the script.
I have tried the concept before in a deployment of Adobe CS6. Only problem is that the users turn off the computer / run out of battery before the installation finishes. The applocker policy is then stuck (because the script cant run it's unlock routine) and all browsers and office applications are unlaunchable until someone from IT fixes it.
Need some handling for this, i guess the task scheduler might be the way to go, or maybe register a WMI event subscriber.

I love this one:
http://java.com/en/download/help/error_25099.xml

Nothing can be done to avoid this untis Oracle gets their thumbs out of their asses.

Ifan fucked around with this message at 09:48 on Feb 7, 2013

alanthecat
Dec 19, 2005

Ifan posted:

(hey, a new Java version just shipped!)

What do you guys use to notify you of updates to your software? I've been using Software Informer installed on my test VM but it hasn't been picking up the Java updates recently.

Ifan
Feb 21, 2006
The Nice Operator from Heaven
We subscribe to a service which delivers the most usual applications (Flash, Java, iTunes etc.) deployment friendly within 3 days of release. It costs a bit, but a huge time saver not having to disable auto updates etc. every time a new version rolls around.

I just get an email when a new version is available on the share, and then add it to SCCM, do some light testing then deployment.

You could probably make a script that checks different websites for you every morning.

devmd01
Mar 7, 2006

Elektronik
Supersonik

Ifan posted:

We subscribe to a service which delivers the most usual applications (Flash, Java, iTunes etc.) deployment friendly within 3 days of release. It costs a bit, but a huge time saver not having to disable auto updates etc. every time a new version rolls around.

Mind pointing me to the website?

EAT THE EGGS RICOLA
May 29, 2008

Ninite pro and PDQ Deploy both do that pretty well too.

Ifan
Feb 21, 2006
The Nice Operator from Heaven

devmd01 posted:

Mind pointing me to the website?

http://services.atea.com/services_uk/services/appupdate.aspx

Has anyone successfully managed to get the Microsoft table (Surface/Pixelsense) working with Windows 8?
It works fine in Windows, and after some tweaking i managed to get the surface mode up and running.
It registers fingers, and clicks on the main screen in surface mode, but i can't click anything to invoke it.

Ifan fucked around with this message at 19:30 on Feb 7, 2013

Number19
May 14, 2003

HOCKEY OWNS
FUCK YEAH


It was nice of Microsoft to completely wreck the build and capture mechanism in SCCM 2012. You're now not able to let a DP fall back to HTTP if the client is roaming or in a workgroup (which is where you should do BnCs from). No, now you have to either have your DP in HTTP mode or have a seperate HTTP DP.

I tried this:

http://www.jamesbannanit.com/2012/05/how-to-build-and-capture-in-configuration-manager-2012-using-https/

Which isn't working due to the problems people mention in the comments. I've fallen back to manually building my reference image now and then capturing it when I'm done. This has just been a huge waste of my time overall.

Kahanamoku
Jan 6, 2013
Does anybody else use SCCM Endpoint Protection for Macs? I'm looking at SCCM 2012 where I work and we're trying to replace McAfee VSE with the Endpoint Protection module for SCCM, but it looks like Macs require PKI communication. I believe means probably have to deploy AD Certificate Services which means an even bigger headache. Does anyone have any experience here that can give some advice?

Yaos
Feb 22, 2003

She is a cat of significant gravy.
Everybody that loves authentication I have great news, we just tried out authentication software called Digital Persona that supports regular Windows login, face, smartcard, bluetooth, RFID, fingerprint, and I believe something else I can't remember. It can run in stand alone mode or with Active Directory. We'll be using it for fingerprint authentication in vehicles to login to laptops and other software. It also supports seamless authentication to 3rd party programs, kind of like LastPass. Credentials can be saved to the server or local only, so if the client computer dies the user won't lose any of their settings.

The server side adds some extensions to AD and Group Policy. On the client side if the client detects the user has no registered authentication methods it provides a simple step-by-step guide on adding their allowed authentication methods that the user will ignore.

goobernoodles
May 28, 2011

Wayne Leonard Kirby.

Orioles Magician.
Anyone have a way to determine what services and/or whatever else might be reliant on a certain (domain admin) account's credentials? I need to either disable a domain admin account or change the password on it.

quote:

Stumbled on your question: where is the Active Directory Domain Administrator account used?
Make sure you have auditing on for success logon.
Leverage LogParser from Microsoft.
create a file named whatever.sql containing the query below:
SELECT
timegenerated, ComputerName,
EXTRACT_TOKEN(Strings,1,'|') AS Domain,
EXTRACT_TOKEN(Strings,0,'|') AS User,
EXTRACT_TOKEN(Strings,3,'|') AS LogonType,
EXTRACT_TOKEN(Strings,13,'|') AS SourceNetworkAddress,
EXTRACT_TOKEN(Strings,14,'|') AS SourcePort,
EventID
FROM 'C:\temp\security-event-log.evt'
WHERE EventID=540 AND SID LIKE 'S-1-5-21-1506026005-1441884114-7473742-500'
Run the following:
C:\Program Files\Log Parser 2.2>LogParser.exe file:whatever.sql -o:datagrid
That will list all the events where the "Administrator" account were used for authentication.

Found this via googling, but maybe there's a better way?

peak debt
Mar 11, 2001
b& :(
Nap Ghost
That's the official way. You switch on account logon success events on your domain controllers (all of them, remember), let the whole thing run for a couple days then filter the security logs of all DCs by the account name you are looking for.

Or just disable the account and wait until somebody complains, that works too...

goobernoodles
May 28, 2011

Wayne Leonard Kirby.

Orioles Magician.

peak debt posted:

That's the official way. You switch on account logon success events on your domain controllers (all of them, remember), let the whole thing run for a couple days then filter the security logs of all DCs by the account name you are looking for.

Or just disable the account and wait until somebody complains, that works too...
Haha yeah, it's a small/midsized company, so making a change knowing it might break something is kind of par for the course. I might just glance through the services on each of our servers and replace anything I see in there, then disable the account and create a replacement domain admin.

If I was to do actually do it the "official way", what form of auditing should I enable?

peak debt
Mar 11, 2001
b& :(
Nap Ghost
"Audit account logon events" is what you want, that's for when some other PC uses this DC to verify a password.
"Audit logon events" is when somebody actually logs in to this DC.

And to be honest, that first setting should be on at least for failures just for security best practices...

Adbot
ADBOT LOVES YOU

Italy's Chicken
Feb 25, 2001

cs is for cheaters
Enterprise Print Management question: How do you deal with multiple sites (10+) and users who randomly work at each site? GPO works fine to add printers to profiles we specify with a windows groups, but then the end-user ends up with 10 different sites' printers in their single profile. I'd really like the users to only see printers that are physically at the site they are signed into at that moment in time. Is there anyway do add printers based on what IP the user's machine is getting or another way???

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply