Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My boss has asked me to find out if a particular user logged in to the domain on a particular date (2/24/2006 to be precise). Is there a resource kit tool, command line utility, or something else that can show me this information?

share|improve this question
add comment

migrated from stackoverflow.com Oct 31 '12 at 12:55

This question came from our site for professional and enthusiast programmers.

1 Answer

The security logs of a domain controller record logon events. Unfortunately, a logon from that long ago has probably been rotated out of the log at this point unless you have extremely little traffic.

If you use centralized logging, you could retrieve it from there. If not, you're out of luck. The Event IDs that you're looking for are 528 and 4624.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.