Friday Mail Sack: Now with 100% more words

re: Friday Mail Sack: Now with 100% more words

Awinish — Mon, 25 Apr 2011 13:22:54 GMT

Thanks for clearing the doubt Ned.

re: Friday Mail Sack: Now with 100% more words

sgrinker — Mon, 18 Apr 2011 15:14:45 GMT

Press exaggerate... noooo! :) Everytime it snows around here, you'd think they never saw the stuff before. "Quick, get 15 reporters stationed around the city! I have to know what this white stuff is!!"

Glad to hear all is well there. Scary situation for all those that were impacted by the madness out there. I'm not even sure now of how many tornadoes they said touched down, but I know it was a unfortunately high number... not to even mention the even more unfortunate death toll.

re: Friday Mail Sack: Now with 100% more words

NedPyle [MSFT] — Mon, 18 Apr 2011 15:07:04 GMT

Hi Awinish. Is your question just that you want to see which DC authenticated a user? If so, you're right that the %logonserver% is not a reliable way to tell.

Getting a network capture is one reliable way. You will see which KDC was returned by DsGetDCName, then where the user sent their AS_REQ and got their TGT back successfully. Another (simpler) way is just to audit logons and kerberos authentication on the DCs; you will see in plain english where a user logged on.

re: Friday Mail Sack: Now with 100% more words

NedPyle [MSFT] — Mon, 18 Apr 2011 15:03:12 GMT

Thanks Steve, we're all good here. You know how the press likes to... exagerate. The so-called Charlotte tornado was in Salisbury, 40 miles north of the city center.

re: Friday Mail Sack: Now with 100% more words

sgrinker — Mon, 18 Apr 2011 14:12:19 GMT

Awesome list of information as always! On a more serious note, hope all you folks are doing fine down there in NC after the tornadoes!!

Steve

re: Friday Mail Sack: Now with 100% more words

Awinish — Sun, 17 Apr 2011 06:27:06 GMT

How to make sure which DC is currently authenticating the user,i guess SET cmd displays the cached logon as well as NSLOOKUP result is also from cache, my query is how to make sure these data are real not cached one.

Thanks

Awinish

re: Friday Mail Sack: Now with 100% more words

NedPyle [MSFT] — Sat, 16 Apr 2011 02:18:21 GMT

And we have a winner! Congratulations Darkseid64. :-)

re: Friday Mail Sack: Now with 100% more words

Darkseid64 — Sat, 16 Apr 2011 01:46:58 GMT

Stump the Geek: My guess, "Alien" and "Bladerunner"