[28519] in Kerberos
Re: Listing what's already mapped
daemon@ATHENA.MIT.EDU (Christopher D. Clausen)
Mon Oct 1 14:15:11 2007
From: "Christopher D. Clausen" <cclausen@acm.org>
Date: Mon, 1 Oct 2007 13:07:16 -0500
Message-ID: <fdrdbt$crh$1@news.ks.uiuc.edu>
X-Complaints-To: news+abuse@ks.uiuc.edu
To: kerberos@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
treschaud33@yahoo.com wrote:
> On Oct 1, 11:27 am, "Christopher D. Clausen" <cclau...@acm.org> wrote:
>>
>> from a cmd.exe prompt (on a computer joined to this domain,) you can
>> run net group "domain computers" /domain to get a list all every
>> computer account. (Assuming you are indeed using computer accounts
>> and not user accounts.)
>>
>> You can then run the setspn.exe -L "computername" for each
>> computername in the above list to see what mappings have been
>> assigned.
>
> Thanks for responding. This didn't work though. It says "Cannot find
> account SERVER10." I tried this a few different ways with no luck.
> Even if this did work there are too many machines in the the domain to
> check (500+).
It works for me. Perhaps you are logged on a user in a different
domain?
C:\>setspn -L KBS-CDC
Registered ServicePrincipalNames for
CN=KBS-CDC,OU=KBS,DC=ad,DC=uiuc,DC=edu:
HOST/KBS-CDC
HOST/KBS-CDC.ad.uiuc.edu
It is pretty easy to write a for command to parse the net group output
and then run setspn.
> I noticed that if I look at the properties of the mapped user in the
> the Active Directory tool it shows the last machine name as the User
> Logon Name on the Account tab. Is there anyway to enumerate this a
> see all the Logon names?
You'd have to write a direct ldap query. Again, I think you would need
to query each object as there are adminitrative limits.
You may be able to use the ldp.exe tool to perform a query. I'm not
sure if the field you want is directly accessible though. You might
still need to query for that field on a per-object basis.
<<CDC
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
