2

I want to check if a user is authenticated right now for my Windows domain. For that I want to use an LDAP query. I learned that there is a group "Authenticated Users" (S-1-5-11) which might do the trick. But how to include it to a LDAP query? (memberOf=Authenticated Users) does not work.

Thanks, Alexander

1
  • 1
    Try the reverse search: look for the UID or whatever it is as a member of that group.
    – user207421
    Oct 22, 2015 at 22:49

3 Answers 3

3

LDAP doesn't track this in the way you need. It can know when users authenticate (check into your hypothetical group), but not when they deauthenticate... it wouldn't know when to remove users from the group.

Now you tagged the queston "Windows", so I'll add that an Active Directory LDAP implemention specifically can tell you this. However, you have to query the DC's event log rather than LDAP, you'll be limited to certain kinds of logins. For example, you can know when users log into and out of domain-joined Windows computers, but not when they close out of a web site using an authentication method tied back to Active Directory, as that session info in only maintained on web servers. You'll also need some fairly complex code to pair up logins/logouts.

2

That can't be queried via LDAP, as the state "authenticated" isn't reflected into LDAP. The group "authenticated users" is something special, a kind of "virtual group" that contains all currently authenticated principals, but it's not an LDAP group.

Among other things, this group would also contain local non-domain users currently logged into a client system.

You should either update your question or ask a new one along the line of "how do I get a list of users logged into a domain" (and use the search function and Google first!).

0

What you might want to try instead is looking at the Domain Controllers the account may have authenticated against to see if, in fact, the account has authenticated recently.

http://www.eventtracker.com/newsletters/following-a-users-logon-tracks-throughout-the-windows-domain/

https://msdn.microsoft.com/en-us/library/bb742435.aspx

Windows Domain Controller Authentication Logon Logging and Forensics

Not the answer you're looking for? Browse other questions tagged .