Re: Logon Count

From: Arild Bakken (arildb__at_hotmail.com)
Date: 02/20/04


Date: Fri, 20 Feb 2004 15:10:53 +0100

Another thing to mention is that if a user locks the workstation/server
(which requires a ctrl-alt-del to unlock) the unclok will also increase the
logon count.

Arild

"Richard Mueller [MVP]" <rlmueller-NOSPAM@ameritech.NOSPAM.net> wrote in
message news:udw1JWy9DHA.2404@TK2MSFTNGP11.phx.gbl...
> Hi,
>
> I also don't know where you see this, but there is a logonCount attribute
of
> user objects, documented here:
>
>
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adschema/ad/win2k_a_logoncount.asp
>
> It is the number of times the user successfully logged in, but a different
> count is kept on each DC - the attribute is not replicated. To get a total
> count for a user, you would have to query every DC. A similar attribute is
> badPwdCount, which is also not replicated.
>
> --
> Richard
> Microsoft MVP Scripting and ADSI
> HilltopLab web site - http://www.rlmueller.net
> --
> "Derek Melber [MVP]" <derekm@braincore.net> wrote in message
> news:OylMXlx9DHA.2184@TK2MSFTNGP09.phx.gbl...
> > Doug, I don't see where you are talking about? Can you give a better
> > description of what you are looking at?THX
> >
> > --
> > Derek Melber
> >
> > "Doug Ketchum" <ketchumd@aruplab.nospam.com> wrote in message
> > news:135f001c3f714$f5e22130$a501280a@phx.gbl...
> > > I am trying to find out information about the logon count
> > > attribute and how it is set. Does anyone know how this
> > > attribut is set up? For example when looking at the
> > > additional account info on the properties of a specific
> > > user, there is a box called logon count. I need to know
> > > what that number is calculated against.
> > > Thansk
> >
> >
>
>



Relevant Pages

  • Re: possible to log when a domain user locks workstation?
    ... Logon Type 7 - Unlock ... Hopefully the workstations on your network automatically start a password ... when a user locks a workstation either on the domain controller OR on ...
    (microsoft.public.windows.server.security)
  • Re: Clear User Name Field when Unlocking PC
    ... cards and requiring that a smart card be used to logon to the computer ... what user they try to logon as. ... registry settings to do that. ... to unlock it you hit ctrl+alt+del, and immediately it shows the user ...
    (microsoft.public.windowsxp.security_admin)
  • Re: bad logon attempts against the Unlock dialog box dont count
    ... Are you trying to unlock the machine with a different user than who has ... Can you please send precise steps to reproduce the problem? ... > a server or workstation using Ctrl+Alt+Delete, bad logon attempts against ...
    (microsoft.public.win2000.security)
  • Re: Logon Type Identification
    ... type 11 is a cached interactive logon which could be of concern unless it is ... Cached logon means ... For local network computers this ... Logon Type 7 - Unlock ...
    (microsoft.public.security)
  • Re: windows 2000 lock workstation auditing
    ... No events are logged when a workstation is locked. ... You see a logon and logoff event at unlock, ... then destroy the resultant, unneeded logon session. ...
    (microsoft.public.win2000.security)