Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can I check in Active Directory to see who has logged to a machine in recently? The machine in question is joined to the domain. The problem is that it's also protected using DeepFreeze, and therefore any history on the machine itself is wiped during it's nightly reboot.

share|improve this question
    
As a bit of context - this is a public computer in a residence hall. There was a theft from the room right across the hall where the computer is, and we know someone was logged in (and present) at the computer at the time of the theft. At very least they must have seen something, and it would be nice to know who that was. –  Joel Coel Dec 15 '10 at 17:46
    
Maybe they had their door closed? Maybe the thief is going to beat them up if they talk? Maybe they left themselves logged in? I applaud your effort to find out everything you can, but there are some situations where technology can't solve it. Of course, maybe the user is also the thief, and when confronted they'll be ravaged by guilt, like in "The Tell-Tale Heart." –  mfinni Dec 15 '10 at 17:53

1 Answer 1

The closest you'll get is by examining the Domain Controller security logs as they record the logins by the user and workstation itself. If those have scrolled off the Security log, you're pretty much out of luck. This is how companies like Splunk make their money.

share|improve this answer
1  
Or you can script something at login to write/append to a file on your fileserver. There's a lot of similar answers on this site and elsewhere. There isn't anything easy & useful built into windows for this. The things that are built in are tough to use. –  mfinni Dec 15 '10 at 17:42
1  
@Mfinni That's what I was trying to get at. Natively? There isn't much. –  sysadmin1138 Dec 15 '10 at 17:49
    
Unfortunately it's a bit late for that :( I'll leave this open for a few days before giving you the accepted answer in case someone has some magic auditing tool that can find this, but I'm not really expecting much. I just needed to follow through a bit for those asking the question to me. –  Joel Coel Dec 15 '10 at 17:50
    
Auditing of logon events has to be enabled, which isn't by default. –  joeqwerty Dec 15 '10 at 17:50
1  
There is eventcomb, that's from MS and makes things a little easier, assuming that the information is 1. in the logs to begin with and 2. still there. –  mfinni Dec 15 '10 at 17:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.