How to Track Domain Controllers Logon Activity in Active Directory

Imagine you are about to perform maintenance and need to shut down or demote a domain controller. Before proceeding, it is important to check if any user or administrators currently has an active session on the DC. This helps prevent unexpected disruptions, avoid interrupting ongoing tasks, and ensures maintenance can be performed safely.

To identify the users currently logged on to the domain controller, you can run the PowerShell snippet below.

$DCs = Get-ADDomainController -Identity "<DCHostName>" 
foreach ($DC in $DCs) { 
    Write-Host "Checking sessions on: $($DC.HostName)" -ForegroundColor Cyan 
    if (Test-Connection -ComputerName $DC.HostName -Count 1 -Quiet) { 
        try { 
            Invoke-Command -ComputerName $DC.HostName -ScriptBlock { quser } -ErrorAction Stop 
        } 
        catch { 
            Write-Host "WinRM issue on $($DC.HostName): $_" -ForegroundColor Yellow 
        } 
    } 
    else { 
        Write-Host "DC not reachable: $($DC.HostName)" -ForegroundColor Red 
    } 
}

This cmdlet uses the quser command to query active user sessions on the domain controller. It retrieves privileged users currently logged on either locally (interactive logon) or through Remote Desktop (RDP) sessions.

Domain controllers play a vital role in Active Directory by managing authentication, controlling user access, and maintaining overall domain security. If these systems are granted unrestricted logon access, it can lead to unintended configuration changes, accidental deletion of important objects, and other security issues. To prevent such risks, it is important to allow only specific users to log on to domain controllers. This can be achieved using Group Policy Objects (GPOs), which enforce consistent security settings across the domain. The following GPO restrictions can be applied to restrict logons to only authorized users:

To implement these restrictions, first create a security group containing the users who should be granted access to domain controllers. Once the group is created, follow the steps below to apply the required GPO settings.

Step 1: Create and link the GPO

Step 2: Configure the logon restrictions

By default, the GPO applies to all domain controllers in the OU. If you want to restrict logons on specific domain controllers only, use Security Filtering in the GPO to target individual DC computer accounts.

Let’s say you have restricted DC access to specific privileged users using Group Policy (GPO). Now, only those users can sign in and access DCs. But imagine those same users are also allowed to sign into standard workstations or other low-tier computers in your environment. When this happens, their highly privileged credentials are left exposed in the memory of those systems. If an attacker gains access to one of these low-tier systems, they can easily harvest the exposed administrative credentials and gain full control of your domain controllers.

Therefore, it is recommended to isolate these privileged accounts, ensuring that the users who can access your DCs are restricted from signing into lower-tier systems entirely.

Limit privileged user access to specific domain controllers using ADUC console

Restrict privileged user accounts to log on to domain controllers using PowerShell

The above method using the ADUC console requires you to navigate to each user account individually, which can be time consuming and inefficient when managing multiple accounts. Instead, you can use the cmdlet below to restrict a privileged user account to specific domain controllers in a single step.

Set-ADUser -Identity "<AdminUsername>" -LogonWorkstations "<DC01>,<DC02>"

Replace <AdminUserName> with the logon name of the admin account you want to restrict, and <DC01>, <DC02> with the names of the domain controllers you want to allow access to.

Tip: You can use these methods to restrict user access to any computers, including workstations and member servers.

Domain controllers generate different logon-related Event IDs based on the authentication and sign-in activity performed by users and systems. Understanding these Event IDs helps admins quickly identify specific logon activities without reviewing all events manually. For example, to identify users remotely accessing the domain controller, you can directly monitor Event ID 4624 with the appropriate logon type and Logon DC filter, instead of analysing every logon event. The following are the key Event IDs to monitor logons on domain controllers: