Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I keep track of offline AD logins in my server? This solution should work all windows server versions since 2000. Users will log in with windows machines.

share|improve this question
    
What is an offline AD login, exactly? –  joeqwerty Jun 23 '11 at 11:43
    
User logs in to windows machine with username pass when windows machine is not connected to the network. I am asking after machine connects to network can I detect login. –  abbas sebastian Jun 24 '11 at 7:53

1 Answer 1

Short of parsing and collecting all of the local logs on the machines in question, there's no way that I'm aware of. Logging in with cached credentials only generates local events.

That said, if you really need to audit it, you could always turn off caching of credentials via GPO. This wouldn't allow offline users to log in, but it would make sure that every single event is logged.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.