.

Need to determine the computer a user account is coming from

<<

JerichoJones

Newbie
Newbie

Posts: 5

Joined: Wed Mar 03, 2010 12:27 pm

Post Wed Mar 03, 2010 12:41 pm

Need to determine the computer a user account is coming from

We use some shared accounts (Yes I know it's bad, I am not allowed to change it.) Someone using the shared account is deleting data on a remote server so I need to figure out what computer they are using when they delete the file.

We have an Active Directory domain.
All PCs run Windows (2000/XP/Win7) and are domain members.

I have turned on auditing and can see the account deleting the file but I don't know of any way to get the computer account as well.

Can it be done?
<<

CadillacGolfer

Newbie
Newbie

Posts: 36

Joined: Thu Dec 14, 2006 1:58 pm

Post Wed Mar 03, 2010 3:30 pm

Re: Need to determine the computer a user account is coming from

<<

JerichoJones

Newbie
Newbie

Posts: 5

Joined: Wed Mar 03, 2010 12:27 pm

Post Thu Mar 04, 2010 12:46 pm

Re: Need to determine the computer a user account is coming from

Thanks for the link. It was informative.

If I read this correctly I am still at square #1.  :(

  Code:
Fron the Article:
To recap just for a moment, when Fred logs on at his workstation for the
first time that day, the domain controller that handles that logon will log
event ID 672, closely followed by an event ID 673 where the Service
Name corresponds to the computer name of Fred’s workstation.


The key statement which seems to get glossed over is "closely followed by". If you have many users authenticating at or near the same time the "closely followed by" is kinda useless.

I can the username and ip from the security log but there is no way to tie them together conclusively.

Maybe I am missing something?
<<

zeroflaw

User avatar

Full Member
Full Member

Posts: 208

Joined: Fri Feb 12, 2010 10:41 am

Location: Holland, Den Helder

Post Thu Mar 04, 2010 1:08 pm

Re: Need to determine the computer a user account is coming from

Ah Active Directories..been ages for me. Can't you just resolve the host name of the machine by pinging the local IP address. I mean, if you have the local IP that should be enough to figure out where it's coming from.

Well at college we have stickers with the computer names on the machines. I believe pinging the local IP with option '-a' was enough to make the host name appear. Then it was really simple to figure out who did what on which machine :P
Last edited by zeroflaw on Thu Mar 04, 2010 1:11 pm, edited 1 time in total.
ZF
<<

unsupported

User avatar

Sr. Member
Sr. Member

Posts: 318

Joined: Sun Feb 08, 2009 3:38 pm

Location: 407

Post Thu Mar 04, 2010 1:51 pm

Re: Need to determine the computer a user account is coming from

JerichoJones wrote:I can the username and ip from the security log but there is no way to tie them together conclusively.


To see if the computer is logged on:
nbtstat -a <ip>

To find the users name, based solely on his username, then look at your local connection cache:
net send <username> "
nbtstat -c
-Un
CISSP, GCIH, GCIA, C|EH, Sec+, Net+, MCP
<<

venom77

User avatar

Hero Member
Hero Member

Posts: 1905

Joined: Mon Dec 11, 2006 3:23 pm

Post Thu Mar 04, 2010 4:06 pm

Re: Need to determine the computer a user account is coming from

unsupported wrote:nbtstat -a <ip>


-A

;)
<<

unsupported

User avatar

Sr. Member
Sr. Member

Posts: 318

Joined: Sun Feb 08, 2009 3:38 pm

Location: 407

Post Thu Mar 04, 2010 8:28 pm

Re: Need to determine the computer a user account is coming from

BillV wrote:
unsupported wrote:nbtstat -a <ip>


-A

;)


Tomato, tomatoe... :p  Thanks for the catch.
-Un
CISSP, GCIH, GCIA, C|EH, Sec+, Net+, MCP
<<

JerichoJones

Newbie
Newbie

Posts: 5

Joined: Wed Mar 03, 2010 12:27 pm

Post Fri Mar 05, 2010 8:12 am

Re: Need to determine the computer a user account is coming from

All this would be fine but I am talking about a shared account.
<<

zeroflaw

User avatar

Full Member
Full Member

Posts: 208

Joined: Fri Feb 12, 2010 10:41 am

Location: Holland, Den Helder

Post Fri Mar 05, 2010 9:06 am

Re: Need to determine the computer a user account is coming from

Sorry, I don't get it. I thought you meant shared as in multiple people can log in with the same account. So you get the IP from the machine that's used to log in. How would you be able to figure out who's sitting at the machine? I don't think you can, unless you're able to find out who used the machine at a specific time.

You asked how to figure out which machine is being used when they delete the file.
ZF
<<

CadillacGolfer

Newbie
Newbie

Posts: 36

Joined: Thu Dec 14, 2006 1:58 pm

Post Fri Mar 05, 2010 10:58 am

Re: Need to determine the computer a user account is coming from

I agree with ZeroFlaw, your orignal question was which computer this was coming from.  You now have an IP address and should be able to track it down.  Your audting should show when the file is deleted and which machines had logegd in using that username, then do process of elimination
<<

unsupported

User avatar

Sr. Member
Sr. Member

Posts: 318

Joined: Sun Feb 08, 2009 3:38 pm

Location: 407

Post Fri Mar 05, 2010 12:18 pm

Re: Need to determine the computer a user account is coming from

Dust for finger prints, setup a video camera, or more serious suggestions would be to setup a key logger or review web proxy logs to see where the logged on user may have gone.
-Un
CISSP, GCIH, GCIA, C|EH, Sec+, Net+, MCP
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Fri Mar 05, 2010 12:30 pm

Re: Need to determine the computer a user account is coming from

JerichoJones wrote:All this would be fine but I am talking about a shared account.


We used to have shared accounts, but when we started getting viruses (and having to waste time cleaning the boxes), and people surfing porn with them, they didn't last much longer. Prior to that, it was a huge fight with the company about the accounts.
OSWP, Sec+
<<

JerichoJones

Newbie
Newbie

Posts: 5

Joined: Wed Mar 03, 2010 12:27 pm

Post Fri Mar 05, 2010 2:21 pm

Re: Need to determine the computer a user account is coming from

Yes I am talking about a user account shared among several people.

The crux of the issue is:

Nothing in the event log ties a user to a computer. If I have the Same ID logging on at the same time there is no way (that I see) to tie them together conclusively.

The computer and user both authenticate but these are seperate entries in the event log with nothing tying them together.
<<

UNIX

User avatar

Hero Member
Hero Member

Posts: 1244

Joined: Mon Apr 28, 2008 9:20 am

Post Fri Mar 05, 2010 2:27 pm

Re: Need to determine the computer a user account is coming from

If the scenario is that many different persons use the same user account on a computer, then there should be hardly a possibility to determine which person is at the moment using the account. One solution would be a webcam which is enabled or some sort of spy cam. If you know each person very well you could analyze logs and look for visited websites etc. as you could maybe match it to a certain person.
<<

JerichoJones

Newbie
Newbie

Posts: 5

Joined: Wed Mar 03, 2010 12:27 pm

Post Fri Mar 05, 2010 2:36 pm

Re: Need to determine the computer a user account is coming from

These are students so WebCams are not an option.

I think I may have to look at sniffing. Bummer. I don't know squat about that.
Next

Return to Forensics

Who is online

Users browsing this forum: No registered users and 1 guest

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software