Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I keep track of offline AD logins in my server? This solution should work all windows server versions since 2000. Users will log in with windows machines.

share|improve this question
What is an offline AD login, exactly? – joeqwerty Jun 23 '11 at 11:43
User logs in to windows machine with username pass when windows machine is not connected to the network. I am asking after machine connects to network can I detect login. – abbas sebastian Jun 24 '11 at 7:53

Short of parsing and collecting all of the local logs on the machines in question, there's no way that I'm aware of. Logging in with cached credentials only generates local events.

That said, if you really need to audit it, you could always turn off caching of credentials via GPO. This wouldn't allow offline users to log in, but it would make sure that every single event is logged.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.