none
Can I get the Mac address in Audit logs of Active directory server for the user's machine which connect to the network/Domain

    Question

  • Hello All,

    I am trying to get the information of all the user's who connect to our Domain network by signing in using the domain account. For this I am using the Windows audit group policies ( I am not sure of there is any other way). I can see when the user tries to login to the network there is a audit event created on the AD/DC server. I can see the Kerberos authentication and logon/logoff events in the audit events under event viewer.  

              However the info which is being populated in these events include :- Hostname, IP address, Username and so on... But I can't see the MAC address of the user machine/system. Is there any way I can get the Mac address of the endpoint system as its one of the important criteria for our project.

    Any inputs on this would be appreciated, incase if there is any other way other than group policies please suggest.

    Thanks,

    Kavish

    Monday, March 9, 2015 12:27 PM

Answers

  • > include :- Hostname, IP address, Username and so on... But I can't see
    > the MAC address of the user machine/system. Is there any way I can get
    > the Mac address of the endpoint system as its one of the important
    > criteria for our project.
     
    If you use DHCP, you can query the DHCP server. There's no builtin
    method to get the MAC address directly.
     

    Martin

    Mal ein GUTES Buch über GPOs lesen?

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))
    Monday, March 9, 2015 1:03 PM