Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If anyone could help, it would be appreciated. I am trying to audit the network. I have list of computers that are active in last 3 months in domain. I have little script that run when user login to the computer and writes the file with computer name. I have 39 computers and only on 23 computers the script was run. So I am chasing up with other 16 computers. My question is how can I find out who has last login to the given computer name?

Many thanks in advance

share|improve this question
add comment

2 Answers

Look in the Security Event Log on those machines. There will be all logon events audited there.

You can filter the logs for event 528. The logon type that you're looking for in those events is 2, which is an interactive logon.

share|improve this answer
    
I would probably do the same, with only difference: Edit GPO to track users Logon/Logoff. Then, if a user logs on with a domain account, log on event will be created on a local machine and on a DC which processed log on request. How to track users logon/logoff This will allow to view all of the events on a single DC (if there are more than one DC, you can connect to remote EventViewer via Event Viewer mmc > Connect to another computer option). –  Volodymyr Nov 7 '12 at 5:59
add comment

Create a login script that logs usernames and dates for each machine on a network share. For example, append %username% and %date% information to the file %computername%.txt Then whenever you have a question about who logged into a computer, it should be in chronological order in the file.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.