Biassoni Riccardo wrote:
> Hi All,
>
> Is there a way to discover Active Directory "Shared" user account or "Service" users Account for auditing purpose?
> I have domain admin privileges and local access to my domain controllers.
In AD, there's no inherent difference between a service account and a
regular user account. In order to actually do this, then, you'd have to
actually find some characteristic of these accounts in your environment,
such as:
+ Being logged onto multiple workstations at once
+ Having services configured using the account
+ Having a particular naming scheme
Obviously these are going to be fairly environment specific, but there
are ways of finding them out (psloggedon and wmic, for instance).
They're going to take a substantial amount of effort to figure out
however, and investigate if you don't have a consistent way of managing
service accounts.
The short answer is: How good's your vbscript/wmi?
- James.
--
James (njan) Eaton-Lee | UIN: 10807960 | http://www.jeremiad.org
"All at sea again / And now my hurricanes
Have brought down this ocean rain / To bathe me again"
> Hi All,
>
> Is there a way to discover Active Directory "Shared" user account or "Service" users Account for auditing purpose?
> I have domain admin privileges and local access to my domain controllers.
In AD, there's no inherent difference between a service account and a
regular user account. In order to actually do this, then, you'd have to
actually find some characteristic of these accounts in your environment,
such as:
+ Being logged onto multiple workstations at once
+ Having services configured using the account
+ Having a particular naming scheme
Obviously these are going to be fairly environment specific, but there
are ways of finding them out (psloggedon and wmic, for instance).
They're going to take a substantial amount of effort to figure out
however, and investigate if you don't have a consistent way of managing
service accounts.
The short answer is: How good's your vbscript/wmi?
- James.
--
James (njan) Eaton-Lee | UIN: 10807960 | http://www.jeremiad.org
"All at sea again / And now my hurricanes
Have brought down this ocean rain / To bathe me again"
https://www.bsrf.org.uk | ca: https://www.cacert.org/index.php?id=3
--
0? *?H?÷
?0?1 0 +0? *?H?÷
? ü0?ú0?â `0
*?H?÷
0y10U
Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *?H?÷
support (at) cacert (dot) org0 [email concealed]
061218190127Z
071218190127Z0B10UCAcert WoT User1&0$ *?H?÷
james.mailing (at) gmail (dot) com0 [email concealed]?"0
*?H?÷
?0?
?ër&âQ?p?ËOÏD±x??D÷u?)¢×?O?K·¨í̳u#ú/¹CFu'ܳiÖHhþZ}?¾p¯?1.)ó?W
ȶº`æ¦à®?»zÓçµ?XQ?Ú Z±5!¥5°Í* êX¿?i?«>ïð¼¬å½mt?E?@
Txú j&U=bh &¼??ø¶·lÙÓj¦È@ÄÞ?j?¬??â3EiÂíKÁ??;À»ÅËD?
¶ô@Ï¥?/;>r¹»ü??ñýÇñ?X?º/e¿S®}?'?6ö âÅ???^¡êG?ål`P{?r»{@Û6¼ B¹ j!Õ?X«£Á0¾0U ÿ00V `?H?øB
IGTo get your own certificate for FREE head over to http://www.CAcert.org02+&0$0"+0?http://ocsp.cacert.or
g0"U 0james.mailing (at) gmail (dot) com0 [email concealed]
*?H?÷
?s@UgOrþ´²?ãM È{P±"MôØÀÅ¢zp«?ø1+ HX[M?ÆbÞñ@H½]pÆté?X¼à/öïN
+Aå{??FÅ8lf§/2ïÙ²Ü)µü2ýt?®Ô¸~?ên<?°2?Åã? CÝ8¥?Gå?oþ° ´x³¹ß4 Lsî¸LÌ?&lZ¡Ú?Â^Ó,?Àþ/NrÌZô°Ê¤Ö?~"i0*yYí¡
[ÈF4¥#ÎP¨t?® à {è¤{?
ªg?#-9Ö<®iFãª"À?"Û¸FJFûÏýQÅÔßhv~Ü.?®N?oK7Yãk?w¤H?ñ1w\j e!Õ2
å?³óåÒÿ?òµ¡?eþrL*©Ñ;~"Ë ×N#âéÊ6Û?]Vkx¬D³Èñ°??¬J?tbµ?Ôʪí äÖs:
t??xSbö5¯fû¿$IGÅóâÔ7·âm?ÞYô<í <üxõ¯jBÑ4"êt?«»ÕÎä¸?[˳a5-̨^ËWÙÓ1ìvc$¹ñ?ÀNÝS[ÜÁý¢)ó?Ï%{¿ üg=ë?å»u S¬BQ~Õ®3?GÛX?gbé~àBÚ?eàÑn%ót?vÊF?gG̺?þ?^,*èx3k?÷táZrf'¥??Å0
?ú0?â `0
*?H?÷
0y10U
Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *?H?÷
support (at) cacert (dot) org0 [email concealed]
061218190127Z
071218190127Z0B10UCAcert WoT User1&0$ *?H?÷
james.mailing (at) gmail (dot) com0 [email concealed]?"0
*?H?÷
?0?
?ër&âQ?p?ËOÏD±x??D÷u?)¢×?O?K·¨í̳u#ú/¹CFu'ܳiÖHhþZ}?¾p¯?1.)ó?W
ȶº`æ¦à®?»zÓçµ?XQ?Ú Z±5!¥5°Í* êX¿?i?«>ïð¼¬å½mt?E?@
Txú j&U=bh &¼??ø¶·lÙÓj¦È@ÄÞ?j?¬??â3EiÂíKÁ??;À»ÅËD?
¶ô@Ï¥?/;>r¹»ü??ñýÇñ?X?º/e¿S®}?'?6ö âÅ???^¡êG?ål`P{?r»{@Û6¼ B¹ j!Õ?X«£Á0¾0U ÿ00V `?H?øB
IGTo get your own certificate for FREE head over to http://www.CAcert.org02+&0$0"+0?http://ocsp.cacert.or
g0"U 0james.mailing (at) gmail (dot) com0 [email concealed]
*?H?÷
?s@UgOrþ´²?ãM È{P±"MôØÀÅ¢zp«?ø1+ HX[M?ÆbÞñ@H½]pÆté?X¼à/öïN
+Aå{??FÅ8lf§/2ïÙ²Ü)µü2ýt?®Ô¸~?ên<?°2?Åã? CÝ8¥?Gå?oþ° ´x³¹ß4 Lsî¸LÌ?&lZ¡Ú?Â^Ó,?Àþ/NrÌZô°Ê¤Ö?~"i0*yYí¡
[ÈF4¥#ÎP¨t?® à {è¤{?
ªg?#-9Ö<®iFãª"À?"Û¸FJFûÏýQÅÔßhv~Ü.?®N?oK7Yãk?w¤H?ñ1w\j e!Õ2
å?³óåÒÿ?òµ¡?eþrL*©Ñ;~"Ë ×N#âéÊ6Û?]Vkx¬D³Èñ°??¬J?tbµ?Ôʪí äÖs:
t??xSbö5¯fû¿$IGÅóâÔ7·âm?ÞYô<í <üxõ¯jBÑ4"êt?«»ÕÎä¸?[˳a5-̨^ËWÙÓ1ìvc$¹ñ?ÀNÝS[ÜÁý¢)ó?Ï%{¿ üg=ë?å»u S¬BQ~Õ®3?GÛX?gbé~àBÚ?eàÑn%ót?vÊF?gG̺?þ?^,*èx3k?÷táZrf'¥??Å1
??0??0?0y10U
Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *?H?÷
support (at) cacert (dot) org [email concealed]`0 + ?Û0 *?H?÷
1 *?H?÷
0 *?H?÷
1
070403151824Z0# *?H?÷
1bæ÷¼
f-D,ó®? \?̾i0R *?H?÷
1E0C0
*?H?÷
0*?H?÷
?0
*?H?÷
@0+0
*?H?÷
(0? +?71?0?0y10U
Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *?H?÷
support (at) cacert (dot) org [email concealed]`0? *?H?÷
1? ?0y10U
Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *?H?÷
support (at) cacert (dot) org [email concealed]`0
*?H?÷
??8æ?v÷?ÒÚ ?µ?½f«¥«ù=$Ü,p?qª)óR!ü02A·Ù???8¹øJ®Ö-lmOÄùMýÎ2]Un
Ï?ñ©lµúy> |#???2ZïÙ»l?]Þ?ìA? ?±ôvª~²<?Ë?]pJøÓô5?ÓÕ©ì7ÈY¶êóÈìWÓp$^®Öd8?6¨ÅgK??¨?ý_³U???"?C WýW V]®täpld<%ÏѤ*í\Ì©?ó;Gé?ú?¹i?<#+ëÒþ¼»ß}³;$FæÎÓ?£ÔCÑ£¥ÓKéµ½¨?wÜÇ?o5\Y
?^iÞáiõ±cK? ?¶
[ reply ]