finding out who has logged into a PC in AD

[Oops_my_bad]

i am wondering if it's possible to find out who was logged into a computer on a 2003 AD domain at a particular time. somebody vandalised a monitor during the lesson. My domain controllers log all the logons but it seems I can only search by username. I know the computername but need to find out who logged on at a certain time. If I look at a logon record from a user, then it shows what PC they logged into. I need this only the otherway round :?

[pallen]

Try looking in the event log on the PC itself? Of course this doesn't mean that person has vandalised it. It could have been someone who didn't bother to log on, just wrecked the monitor anyway.

One question though, if it happend in the lesson, didn't the teacher notice it?

If you want to keep a log on who has logged into a PC you can use a logon and logoff script to do it. It has been posted on here a few times and is really usefull. Try a search, or I'm sure someone will put a link to the thread.

[Oops_my_bad]

I agree with the teacher should have noticed it, and understand it could have been anyone.

We don't do PC log auditing (as I've just discovered)

Thanks for the login script tip off, will have a look

[PEO]

thats bad classroom management.

I had to replace a network point on the wall behind a pc because some lads decided it would be fun to shove each over in to the computer.

[pallen]

Maybe usefull for you...
http://www.edugeek.net/index.php?nam...=logon+scripts

[mrforgetful]

We use AB Tutor Control which can keep a log of who logs in, what sites they go on and what programs they use.

I agree though it should be a teacher watching problem, unfortunately it's often shunned when it's not theire equipment...

[projector1]

you could remotely connect to the computer from the computer management snapin view the pc's event log and filter it based on the date range (pick this up in doing the MCSE 270 module) very useful if you need to carry out work on a pc whilst some one is logged in.