Login History

I am after a set of login histroy to find out what user has defaced laptop keyboard

What the easyest way to track this??

Is there anywhere that stores what user has logged in on what machine??

I have the name of the machines but i need to find the users who logged in

Thanks

Fil

Hi Fil,

If you go to the Event Viewer, in Computer Manager and select Security you should be able to view who has logged on to and off the machine.

Hope this helps,

Maximus R

Quote:

---

Originally Posted by MaximusR

Hi Fil,

If you go to the Event Viewer, in Computer Manager and select Security you should be able to view who has logged on to and off the machine.

Hope this helps,

Maximus R

---

hi Maximus

I have checked the 2 machines but there is only one entry going back to 2007

any other places?? servers or anything?

tar

Phil

This is of no comfort to you now but I recommend that you use a script to record who logs and where. The thread linked below details a script that I am now using and have caught a few kids out now

Record Logon

Have a look in c:\documents and settings for cached profiles. You might find the last modfied date of one of the files will give you a clue.

It you have a printer setup you might also want to have a look on your print server since if they printed anything.

For future reference you might want to add something along the lines of "echo %USERNAME% %TIME% %DATE% >> [some secret location]\%computername%.txt" to your logon script.

Also get papercut logger (it's free) and will log all print jobs.

Quote:

---

Originally Posted by K.C.Leblanc

Have a look in c:\documents and settings for cached profiles. You might find the last modfied date of one of the files will give you a clue.

It you have a printer setup you might also want to have a look on your print server since if they printed anything.

For future reference you might want to add something along the lines of "echo %USERNAME% %TIME% %DATE% >> [some secret location]\%computername%.txt" to your logon script.

Also get papercut logger (it's free) and will log all print jobs.

---

i tend to use a slightly different script as i find that some pcs for no obvious reason log time with fractions of a second and some dont making the data a swine to compare in excel later so i add a mytime variable and dump that instead

Code:

---

echo -------Log user access to Machine-------
set mytime=%TIME:~0,-3%
echo %username%,%computername%,%mytime%,%date% >> \\server\userlog$\userlog.txt

---

Our script dumps to a database - with a nice little web based query front end - makes searching this stuff down nice & easy

looked in docs and settings - profiles are couple days out

Will need to look at setting something up

Thanks

Hi Phil,
If the laptop is connected to wireless you may have a wireless access log somewhere? Access Point, RADIUS server etc. Or you could look at the event viewer on the domain controller?

Maximus R