My boss has asked me to find out if a particular user logged in to the domain on a particular date (2/24/2006 to be precise). Is there a resource kit tool, command line utility, or something else that can show me this information?
Tell me more
×
Server Fault is a question and answer site for
professional system and network administrators. It's 100% free, no registration required.
|
|
migrated from stackoverflow.com Oct 31 '12 at 12:55
|
The security logs of a domain controller record logon events. Unfortunately, a logon from that long ago has probably been rotated out of the log at this point unless you have extremely little traffic. If you use centralized logging, you could retrieve it from there. If not, you're out of luck. The Event IDs that you're looking for are 528 and 4624. |
|||
|
|
