Is it possible with Windows Server 2012 AD what users were logged in to certain computers? I would like to see list of all users that were using some computer. i.e. logged to certain computers ever or for some period of time.


Configure GP and use AD events. The steps, who to achieve this: https://deployhappiness.com/find-out-what-computer-a-user-logged-into/

  • Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Gerald Schneider Feb 13 at 10:15
  • Are there any implications to granting all domain users read/write permission to the managedBy attribute of all domain computers? – twconnell Feb 13 at 21:16

I would very much NOT recommend the process of updating an AD attribute to track who logged onto a computer. It's not going to give you a historical view, for a start.

There are two ways to do it, that I can think of:

  • Use a syslog service to capture and aggregate logon events from all workstations (if you're using local accounts) or domain controllers (if you're in a domain). Preferably the kind of tool that you can use to capture and report on the actual data you're after. You should have Group Policy configured to enable auditing on logon events for all domain members. Event 4624 in the DC security log will give the workstation and account name that logged on.
  • Less ideally, configure a user logon script in group policy to write to a per-workstation text file on a network location with the username and logon time. You can configure the folder permissions to allow users to write but not read file contents.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.