|
|
|
Forum Newbie
Group: Forum Members
Last Login: 2/24/2011 4:13:38 PM
Posts: 1,
Visits: 0
|
|
| I am trying to figure out the best tool to extract domain logins from our domain controllers, such that I can create a network map that shows every credential used by any given IP address in our network. What would be the best tool to accomplish this task?
|
|
|
|
|
Expert
Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 326,
Visits: 0
|
|
Use logparser to query all your DC security logs for event 672 or its equivalent in win2008, generate a result set of IP and user names (you'll need to use the EXTRACT_TOKEN function to get user name and IP) and include the keyword distinct so that it dedupes the result set. To get those 2 fields out of the Strings field you do something like EXTRACT_TOKEN(Strings,5,'|') AS ClientAddress,
|
|
|
|
|
Forum Newbie
Group: Administrators
Last Login: 4/13/2009 5:07:47 PM
Posts: 1,
Visits: 0
|
|
|
|
|