Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm completing an audit and need to know the following information below. I have a domain controller with active directory, but let me know if you need any more info. I would like something as simple as possible.we have around 230 pc so would take a long time to go around all of them one by one. any suggestions welcome! Thanks.

Username Computer_Name Last_logon
Fred      02457         12/06/2011
share|improve this question

You would want to enable Audit Logging on your DC. If you don't have auditing enabled now, you won't be able to gather this information until you enable it. The easiest way to do this would be through Group Policy. Open the Group Policy Management Console and right click and choose "Edit..." on the "Default Domain Controller Policy" that is linked to the Domain Controllers container. Drill down to "Computer>Windows>Security Settings>Local Policies>Audit Policy". You'll want to enable the "Audit Account Logon" and audit either "successful" attempts, "failed" attempts, or both.

You haven't mentioned what OS your DC is running. If it's 2008/ 2008 R2 you have some additional Auditing options.

The above settings will generate events in the Security Event log on your DCs when a users logs on to a domain PC. Even with auditing set, you still need to go through your event logs to gather the information.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.