First published on TechNet on Dec 10, 2018
Long overdue post revisiting the question about whether and when to block the use of local accounts, particularly for re...
Published Jun 18, 2019
Version 1.0
Blog Post
HI Steve, I'm really interested in everything that can help here tracking down the original user..
I already found this https://blogs.technet.microsoft.com/kfalde/2015/11/18/laps-audit-reporting-via-wef-posh-and-powerbi/ and this can help a little bit but there is always the problem of a jump server.. that is if the user access a middle server from where he goes to the AD to get the admin password and then connect to the remote server as Administrator I can loose the original user as he could have logged on as a local user in the middle server..
Unfortunately GDPR has very strict rules on the logging.
Can you please explain more in detail your idea?
Thanks
-mario