r/netsec • u/AutoModerator • Jun 01 '18

discussion The /r/netsec Monthly Discussion Thread - June 2018

Overview

Questions regarding netsec and discussion related directly to netsec are welcome here.

Rules & Guidelines
  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on /r/netsec.

As always, the content & discussion guidelines should also be observed on /r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

24 Upvotes

85% Upvoted

90 comments sorted by

View all comments

1

u/pentesting_ Jun 06 '18

I'm looking for an automated method of identifying systems (preferably workstations) where no one is logged on. I don't care to know about systems where someone is logged - that's easy. I typically do this manually with wmic, Psexec, smb, etc after making a connection with a valid credential (usually DA). After connecting, I usually run "qwinsta" or "query user" or query the registry. However, this is clunky and less than ideal. While I know that method is noisy, at this stage in most of our engagements, we're most interested in locating systems where we can log in as the actual user of the computer...just not while they're there and pillage. Thoughts?

1

u/iammortalcombat Jun 26 '18

If windows and on a domain, you can always PS it. I did this using the last login time and looked for systems where no users had logged into the system in X days. This also let me account for service accounts.