Tracking Administrator Logons

My company doesn't give users Administrator access to their workstations. The local Administrator password is the same on all 1500 Windows NT Workstation systems in our domain, and we change the password every 30 days. We wanted to know when a user logged on to a workstation using the default Administrator account so that we could change the password immediately rather than allow 30 days of unauthorized access.

To let us know when a user logged on as Administrator, one option was to turn on auditing on all workstations to track successful and failed logon attempts, then use a third-party software package to monitor the logs and check for Administrator logons. However, this solution required the IT staff to manually turn on auditing and install the third-party agent on each of the 1500 workstations. In an attempt to automate this process, I used the following steps:

1. I created the following userchk.cmd batch file:
If %username%==Administrator goto log
goto end
:log
now >> c:\winnt\system32\userchk.txt
echo %computername% >> c:\winnt\system32\userchk.txt
:end
2. I used a homegrown software-distribution utility that uses Administrator rights during logon to add c:\winnt\system32\userchk.cmd to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry subkey.
3. I copied the userchk.cmd file to the workstation's c:\winnt\system32 directory during the user logon script.
4. I modified the user logon script to look for c:\winnt\system32\userchk.txt. If this file is present, use the target \\server\share\%computername%.txt to copy it to a central server. (This step gives the file a unique name on the central server.)

This solution causes the system to run userchk.cmd each time a user logs on. If the current logon name is Administrator, the file echoes the time and computername to userchk.txt. The next time the machine runs the domain logon script, the system copies the userchk.txt to the central server where the IT staff can audit it. However, this solution doesn't work if users are a member of the local Administrator group and log on with their usual username.

—Stephen Scharf
Sscharf1@aol.com