I am after a set of login histroy to find out what user has defaced laptop keyboard
What the easyest way to track this??
Is there anywhere that stores what user has logged in on what machine??
I have the name of the machines but i need to find the users who logged in
RE: Login History
If you go to the Event Viewer, in Computer Manager and select Security you should be able to view who has logged on to and off the machine.
Hope this helps,
Originally Posted by MaximusR
I have checked the 2 machines but there is only one entry going back to 2007
any other places?? servers or anything?
This is of no comfort to you now but I recommend that you use a script to record who logs and where. The thread linked below details a script that I am now using and have caught a few kids out now
Have a look in c:\documents and settings for cached profiles. You might find the last modfied date of one of the files will give you a clue.
It you have a printer setup you might also want to have a look on your print server since if they printed anything.
For future reference you might want to add something along the lines of "echo %USERNAME% %TIME% %DATE% >> [some secret location]\%computername%.txt" to your logon script.
Also get papercut logger (it's free) and will log all print jobs.
i tend to use a slightly different script as i find that some pcs for no obvious reason log time with fractions of a second and some dont making the data a swine to compare in excel later so i add a mytime variable and dump that instead
Originally Posted by K.C.Leblanc
echo -------Log user access to Machine-------
echo %username%,%computername%,%mytime%,%date% >> \\server\userlog$\userlog.txt
Our script dumps to a database - with a nice little web based query front end - makes searching this stuff down nice & easy
looked in docs and settings - profiles are couple days out
Will need to look at setting something up
If the laptop is connected to wireless you may have a wireless access log somewhere? Access Point, RADIUS server etc. Or you could look at the event viewer on the domain controller?