Is there any software or real-time tool i can see the computer (host) names / ip address which an AD user logged into?
-
2You'll have to scrape event logs on all your domain controller computers to get this. For all that I've seen this asked-for I'm amazed that there isn't a product that does it. It probably wouldn't even be that difficult to write (at least, in a manner that works in a passable fashion... it's just another loose convergence multi-master database replication problem, so it has a lot of hairy edge cases).– Evan AndersonJan 31, 2011 at 17:04
Add a comment
|
3 Answers
Manageengine makes a product that will do the log parsing for you, It's not realtime (but you can re-run it)
If you're running DHCP on the AD server you can check DHCP leases - might be better than nothing.
-
1