Tracking Administrator Logons

My company doesn't give users Administrator access to their workstations. The local Administrator password is the same on all 1500 Windows NT Workstation systems in our domain, and we change the password every 30 days. We wanted to know when a user logged on to a workstation using the default Administrator account so that we could change the password immediately rather than allow 30 days of unauthorized access.

To let us know when a user logged on as Administrator, one option was to turn on auditing on all workstations to track successful and failed logon attempts, then use a third-party software package to monitor the logs and check for Administrator logons. However, this solution required the IT staff to manually turn on auditing and install the third-party agent on each of the 1500 workstations. In an attempt to automate this process, I used the following steps:

This solution causes the system to run userchk.cmd each time a user logs on. If the current logon name is Administrator, the file echoes the time and computername to userchk.txt. The next time the machine runs the domain logon script, the system copies the userchk.txt to the central server where the IT staff can audit it. However, this solution doesn't work if users are a member of the local Administrator group and log on with their usual username.

—Stephen Scharf
[email protected]