Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to run a query in AD to check what PCs a user has logged into recently.

regards Mike

share|improve this question

As far as I am aware, AD does not keep a log of what PC's a user logged onto, the only thing it logs is the last logon time. This item is not synchronised across domain controllers either, so can be a little unreliable if you have multiple DC's, unless you poll all DC's to find the latest time.

You could enable logging of User Logon events in the security log, export the log to CSV and use this to generate the report you are after. This also suffers from the fact that logon information is only logged by the DC that processes the request, and is not synchronised between DC's, so you would need to get this data from all of your DC's.

The PsLoggedOn script will tell you what machines users are currently logged into, if that is any use to you.

share|improve this answer
AD does not store any list of the PCs a user has logged-on to. If you choose to use the security logs on your DCs to determine where users are logging-on, be aware that you need to monitor every security log on every DC because, technically, user logons can be processed by any DC. – Evan Anderson Oct 26 '09 at 15:43
Thanks for bringing that up Evan, updated the answer. – Sam Oct 26 '09 at 16:17
Don't forget the Resource Kit Tool, eventcombmt.exe. It can easily be configured to contact all of your DCs and pull logon related audit data (there is even a pre-configured query for it). This is the simplest "git 'er done" approach. For more regular monitoring see products like SCCM, Quest Intrust, Splunk!, etc. – Ryan Fisher Apr 1 '10 at 17:29
If you're using Server 2008, and you have account auditing turned on for the Directory, you can search the various DC logs for Kerberos Authentication Service audit success/failures. You wan to find the "TGT" events (id 4768) as these are the initial Kerberos logon audits and will log the client source IP. – Ryan Fisher Apr 1 '10 at 17:41

Not aware of any way to do this directly with AD, but if you have any kind of machine auditing system this should be fairly easy.

We use SCCM (aka SMS) for software deployment, as well as various auditing, and use this script as a quick look at where people have logged in. The full Asset Inventory service gives you much more info than this, but this is quick and easy. It's not 100% reliable (particularly if the user has logged onto multiple machines in a short time frame) but we use this script which should do what you want:

'Central Site Server
strComputer = "***"
'Central Site Code
strSiteCode = "***"

'Get userID
strUserName = InputBox ("Enter User Name")

'Set up the connection String
Set objWMIService = GetObject("winmgmts://" & strComputer & "\root\sms\site_" & strSiteCode)
'Get info
Set colUser = objWMIService.ExecQuery("select SMS_G_System_COMPUTER_SYSTEM.Name, SMS_R_System.LastLogonUserName from  SMS_R_System inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_R_System.LastLogonUserName like '" & strUserName & "%'")
For Each objUser in colUser

LastUserName = ObjUser.SMS_R_System.LastLogonUserName
MachineName = ObjUser.SMS_G_System_COMPUTER_SYSTEM.Name


'Display info
MsgBox ("Last machine that "& LastUserName &" logged onto was "& vbcrlf & MachineName)
share|improve this answer

there definately is a way, we currently have it setup with a script that runs when a user logs in, it pops the pc name and logon time in the notes under the telephones tab in AD.. I will find the script and will post it up....


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.