Find IP of who is logging in to Win2000 Server

[timscronin]

We have a Win2000 Server that we are invesigating whether or not security may have been compromised on. A SQL Server account seems to be logging in at 3 AM, and we don't believe the SQL Server is doing it. The server is running Win2000, with Terminal Server, and Citrix. In SQL Server you can look at current activity and not only look at the user and login, but also the IP address of where the login originates. Is there a way to view this on WIn2000

 

[hkunnana]

You will need to use third party apps to be able to tell the IP any host. W2K doesn't have any way ( I know ) to do that.
What you can do is to enable auditing for logon events, so you will be abe to tell the (logon user, workstation's NetBIOS name, logon time,.. etc.)

Actually I am not an expert in the SQL server, but I think your SQL accounts need NOT to be domain accounts, meaning that whoever uses the SQL needs not to logon to your W2K server/domain. The clint only needs ip and a way to logon to the SQL server. If this is true you will not find a trace for that activity in the W2K server security log, but you may find it in the SQL server log (if you have such thing).

 

[timscronin]

Any recommendation for one of these 3rd party apps?