Re: Tracking Kerberos Tickets

What about going by the password age for the computer account? Live
computer accounts will have their passwords changed automatically every so
often, I believe.

"Sasi" <Sasi@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A1401E45-9A1F-4AAB-BC70-736F9D8AA278@xxxxxxxxxxxxxxxx
is there a way (programatically prefered but utilities also welcomed) to
track and log kerberos Tickets issued by a Domain controller? is there any
API or something that I can use to list all tickets granted by a server
during a specific time?

I need this because I want to write a program that detects and removes
dead/unused computer accounts in AD .my idea was to track computer
accounts
that had requested TGT during the past <some duration>,filtering them out
from other computers and deleting the rest.

any better idea to fulfill this goal is welcomed.of course I prefer that
idea to not involve in installing any client program on workstations.


.

Relevant Pages

  • Re: Tracking Kerberos Tickets
    ... You would need to use audit events from the event log for this. ... track and log kerberos Tickets issued by a Domain controller? ... I need this because I want to write a program that detects and removes dead/unused computer accounts in AD .my idea was to track computer accounts that had requested TGT during the past,filtering them out from other computers and deleting the rest. ... any better idea to fulfill this goal is welcomed.of course I prefer that idea to not involve in installing any client program on workstations. ...
    (microsoft.public.platformsdk.security)
  • Re: Tracking Kerberos Tickets
    ... You need to retrieve pwdLastSet and then calculate the password age from that. ... Joe Richards Microsoft MVP Windows Server Directory Services ... computer accounts will have their passwords changed automatically every so often, ...
    (microsoft.public.platformsdk.security)
  • Re: Identify inactive computer accounts.
    ... a lot of tipsregarding all the unwanted computer accounts and how to delete ... at the lastlogon value unless you only have one domain controller. ... as well as password age. ... "Yuriy" wrote in message ...
    (microsoft.public.win2000.active_directory)