Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My boss has asked me to find out if a particular user logged in to the domain on a particular date (2/24/2006 to be precise). Is there a resource kit tool, command line utility, or something else that can show me this information?

share|improve this question

migrated from Oct 31 '12 at 12:55

This question came from our site for professional and enthusiast programmers.

The security logs of a domain controller record logon events. Unfortunately, a logon from that long ago has probably been rotated out of the log at this point unless you have extremely little traffic.

If you use centralized logging, you could retrieve it from there. If not, you're out of luck. The Event IDs that you're looking for are 528 and 4624.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.