I need to find a utility to tell me if a user is logged on more than once on an NT4 domain -- dumpsec and reallastlogon.exe tell me the last time someone logged on, but they do not tell me if a user logged on more than once.
Unfortunately, I don't know of one, and neither do my contacts at Microsoft.
The problem is that the domain controller records the last logon time as a property of the user account. This isn't replicated across all the domain controllers, and consequently, you have to get the data from all the controllers and correlate it yourself.
For more information on this topic, visit these other searchSecurity resources:
Best Web Links: Securing Microsoft Products/Applications
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.