Which Users at Which System?

A member of our HowTo for Security mailing list mailing list recently asked how they could determine which user is logged in to which system? The goal was to identify user who may be using a generic guest account instead of their properly assigned user account.

Microsoft's David LeBlanc quickly pointed out that by using the Netwatch tool found in the Windows NT Resource Kit, an administrator can quickly determine such information.

Netwatch is a small desktop application that allows a series of systems to be monitored. Monitoring can include open files, hidden shares, shares in use, connected users, and more. The tool is very similar to NT's built-in Server Manager tool, but lacks support for service monitoring. Netwatch has a better screen layout than Server Manager, which let's you watch several machines on a single display.

If you've never seen the Windows NT Resource Kit, then you are truly missing out on some fantastic tools.

http://mspress.microsoft.com/reslink/nt40/kits