Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have spent a short period of time in an office recently, and I was able to dump the event logs on to a USB drive.

There are only XP Pro machines in the office. Is it possible that there is a domain running?

What should I look for in the Event Logs to work out whether they are in a domain?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

I'd recommend you check the Security section of the Event Viewer (or the appropriate log): enter image description here

If you open an entry here, you'll see a log entry for some authentication event. The event I opened here was validated against the domain WINXP. That is, in fact, the name of the workstation, not a domain controller:
enter image description here

So this could be a hint that the whole machine is not connected to a domain. If you check more entries, you can see if there ever was an authentication event against another machine (maybe a domain controller).

I don't think this would be a reliable way to determine if a client is, in fact, a domain client. But it might help.


Just FYI, a quick way to determine if the machine is part of a domain if you have access to it could be to:

echo %LOGONSERVER%

on a command prompt. If it prints the local machine name, it's not part of a domain. Otherwise, it should print the name of the domain controller.

share|improve this answer

Just do a search for 3260 this is the event that will show in the system log when a PC joins a domain.

Event 3260

share|improve this answer
    
Is that emitted with every user logon or only when the machine initially joins the domain? –  Oliver Salzburg Mar 12 '12 at 13:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.