BKiddo wrote:

VanguardLH wrote:

BKiddo wrote:

Suppose you have 100 Windows XP or 7 PCs, can you get a report from the
Domain Controller to know which local users are created in each PC?

So why did you give these users the password to the Administrator or another
admin-level local account so these users could create more local accounts?
If they are admins then you gave them your control.

The cliente did it; and now I have to audit it!

I suppose you could use a one-time login script that you push via domain
policies that runs a batch file with something like (this is off the top of
my head):

@date /t
@time /t
@net user

called listuser.bat which the login script runs as:

listuser.bat uncpath\accounts\%computername%\userlist.txt

where uncpath is to a network host to which all users have permission to
write into the "accounts" subfolder and where you can go lookup the output.
Some you wouldn't care about, like Administrator since this account always
exists (whether the user can log onto that local account or not), and others
are accounts designed for use by particular services or the OS. Rather than
use a one-time logon script, you could keep it enabled all the time for all
users and then append the output from each of their logins to monitor when
they change (add or delete) the accounts on their host, as in running:

listuser.bat uncpath\accounts\%computername%\userlist.txt

( does an overwrite, does an append).