I have a strong feeling one of our desktop support techs is doing this, but I want to see if I can track this down before I start accusing people. I just dont know how...
While logging into a local web app, the drop down lists a bunch of random entries. I strongly feel its Workgroups not domains, but either way I want to find a way of tracing it.
Look at the following picture:
NTLM is detecting all these domains/workgroups. How do I track them down?
I suspect someone is removing machines from the domain and entering in these as workgroups...