4

If anyone could help, it would be appreciated. I am trying to audit the network. I have list of computers that are active in last 3 months in domain. I have little script that run when user login to the computer and writes the file with computer name. I have 39 computers and only on 23 computers the script was run. So I am chasing up with other 16 computers. My question is how can I find out who has last login to the given computer name?

Many thanks in advance

3 Answers 3

3

Look in the Security Event Log on those machines. There will be all logon events audited there.

You can filter the logs for event 528. The logon type that you're looking for in those events is 2, which is an interactive logon.

1
  • I would probably do the same, with only difference: Edit GPO to track users Logon/Logoff. Then, if a user logs on with a domain account, log on event will be created on a local machine and on a DC which processed log on request. How to track users logon/logoff This will allow to view all of the events on a single DC (if there are more than one DC, you can connect to remote EventViewer via Event Viewer mmc > Connect to another computer option). Nov 7, 2012 at 5:59
3

The registry key, that MDMarra is referring to should be HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI (assuming later than XP). Look in LastLoggedOnUser.

0
1

Create a login script that logs usernames and dates for each machine on a network share. For example, append %username% and %date% information to the file %computername%.txt Then whenever you have a question about who logged into a computer, it should be in chronological order in the file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .