2

I want to check if a user is authenticated right now for my Windows domain. For that I want to use an LDAP query. I learned that there is a group "Authenticated Users" (S-1-5-11) which might do the trick. But how to include it to a LDAP query? (memberOf=Authenticated Users) does not work.

Thanks, Alexander

closed as off-topic by Greg Askew, mdpc, HBruijn Oct 23 '15 at 11:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – Greg Askew, mdpc, HBruijn
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Try the reverse search: look for the UID or whatever it is as a member of that group. – user207421 Oct 22 '15 at 22:49
3

LDAP doesn't track this in the way you need. It can know when users authenticate (check into your hypothetical group), but not when they deauthenticate... it wouldn't know when to remove users from the group.

Now you tagged the queston "Windows", so I'll add that an Active Directory LDAP implemention specifically can tell you this. However, you have to query the DC's event log rather than LDAP, you'll be limited to certain kinds of logins. For example, you can know when users log into and out of domain-joined Windows computers, but not when they close out of a web site using an authentication method tied back to Active Directory, as that session info in only maintained on web servers. You'll also need some fairly complex code to pair up logins/logouts.

2

That can't be queried via LDAP, as the state "authenticated" isn't reflected into LDAP. The group "authenticated users" is something special, a kind of "virtual group" that contains all currently authenticated principals, but it's not an LDAP group.

Among other things, this group would also contain local non-domain users currently logged into a client system.

You should either update your question or ask a new one along the line of "how do I get a list of users logged into a domain" (and use the search function and Google first!).

0

What you might want to try instead is looking at the Domain Controllers the account may have authenticated against to see if, in fact, the account has authenticated recently.

http://www.eventtracker.com/newsletters/following-a-users-logon-tracks-throughout-the-windows-domain/

https://msdn.microsoft.com/en-us/library/bb742435.aspx

Windows Domain Controller Authentication Logon Logging and Forensics

Not the answer you're looking for? Browse other questions tagged or ask your own question.