Command to find out the DC a user is logged into

This topic contains 3 replies, has 2 voices, and was last updated by Profile photo of Mark Hammonds Mark Hammonds 1 year, 5 months ago.

  • Author
    Posts
  • #32787
    Profile photo of Mark Hammonds
    Mark Hammonds
    Participant

    Finally I have an issue worthy of posting. I have a script that gathers info from a users computer. I was asked to add "domain controller user logged into" after researching I have found you can run a dos command on the users machine "Set Logonserver" will return this info. is there a way to capture this to a variable or is there a powershell equivalent WMI command or is this info captured in an event log file on the users machine? my script already contacts the users machine to pull info from the users registry.

    I should have rephrased the title "authenticated to"

  • #32789
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    In PowerShell, it would just be $env:LOGONSERVER, but you'd have to check that value running as the user account. Collecting the information remotely would be trickier, and I would probably resort to just checking logon events in the Security log.

  • #32790
    Profile photo of Mark Hammonds
    Mark Hammonds
    Participant

    your right the problem with $env:LOGONSERVER is if I try to do a invoke-command -computer $computer -scriptblock{$DC = $env:LOGONSERVER} it will most likly return the DC my admin account logged into

    do you know the security log that might contain that info?

  • #32792
    Profile photo of Mark Hammonds
    Mark Hammonds
    Participant

    $Var = Get-WmiObject -Class win32_ntdomain -Filter "DomainName = 'CAM'" -ComputerName $computer

    Thanks Bob McCoy

You must be logged in to reply to this topic.