NTLast v2.6

Reviewing event logs is one of the most important of the tasks that you need to perform regularly on your network. NT OBJECTives' NTLast v2.6 is a great security-event-log analysis tool that fits well in any Windows NT network environment. NTLast is a command-line tool (similar to the UNIX last command) that can search local and remote NT security event logs to display entries in an easy-to-read onscreen report. The product can open and review archived event logs and pipe output to a text file. To add to its functionality, NTLast can distinguish between local console logons and remote network logons and can even filter and display Microsoft Internet Information Server (IIS) logons.

Because NTLast is a command-line tool, it supports a variety of command-line switches, depending on what kinds of log entries you want to display. For example, with an -f command-line switch, NTLast displays all failed logon attempts that an NT system's security event log stores.

Table 1 lists the command-line switches that NTLast supports. (Please note that all NTLast switches are case-sensitive.) NTLast reports on last successful logons, last failed logons, last interactive logons, last remote logons, logons by username, total number of logons, and IIS logons. In addition, NTLast supports command-line switches that help format the output for your viewing preference. For example, NTLast supports a condensed output and a verbose output and can filter out usernames from reports.

Installation and Use
Installing NTLast couldn't be easier—I simply copied the tool's executable file to my directory of choice, and NTLast was ready for use. Using NTLast is also easy, but you must fulfill two prerequisites. First, you must enable auditing so that NT records events into the event log. Second, if you plan to monitor a remote NT system using NTLast, you'll need administrative access to that machine to access its event log files.

Prudent administrators will find many ways to make productive use of NTLast. For example, you can regularly poll logs for failed logon attempts using the -f command-line switch. During my testing of NTLast, I wanted to monitor three machines for failed logon attempts and have NTLast save the report to a text file and also email the report to my inbox. To accomplish this, I created a simple batch file with the necessary commands and used NT Scheduler to cause the batch file to run at regular intervals. My batch file looked like this:

NTLAST -f -r -n 50 -m \\NTBOX1 
   > FAILED.TXT
NTLAST -f -r -n 50 -m \\NTBOX2
   >> FAILED.TXT
NTLAST -f -r -n 50 -m \\NTBOX3 
   >> FAILED.TXT
BLAT FAILED.TXT -s "Failed Logon
   Report" -t mark@ntsecurity.net 
   -server mail.ntsecurity.net
   

The first three commands poll the systems (NTBOX1, NTBOX2, and NTBOX3) for the last 50 failed logon attempts; -f tells NTLast to get the failed logons, and -n 50 tells NTLast that I want the last 50 failed logons. The -m switch instructs the machine to poll, and the -r switch specifies a display of the failed remote logon attempts. >> FAILED.TXT tells NT to append the command-line output to the file named failed.txt. Note that the first command uses > FAILED.TXT instead of >> FAILED.TXT. Using one greater-than symbol instructs NT to overwrite the file or create a new file, whereas two greater-than symbols tell NT to append the output to the newly created file.

The last command, BLAT, is the program I use to send the file via email. Blat is a command-line SMTP mail-sending tool that you can download for free from WinSite at http://www.winsite.com/winnt/netutil/page2.html.

The emailed report that Screen 1 shows uses condensed output in an easy-to-read layout, and it clearly shows the information I wanted about failed logon attempts. Each line in the report shows the username, the system the user was trying to log on to, the system the user was using to originate the logon, and the date and time of the failed logon attempt.

My example only scratches the surface of the possibilities for using NTLast productively. I find the tool to be an excellent addition to my NT security toolkit, and at a price of $29.95, NTLast is one heck of a bargain. I highly recommend that you add this utility to your toolkit.

End of Article