Need to see who logged onto a machine

[LeonieCol]

I need to find out who was logged onto a particular machine over the weekend period.

 

I thought that this information would be available on the security log of that machine, but it is not, all that is there is a Success Audit dated 27th April 2007.

 

Is there another way to find this out through either the local machine or the server?

[Geoff]

Look at the modification times of the cached user profiles.

[richard.thomas]

Theres a few scripts that people have made. Have a look in the scipts section of the forum.

There is a log in the event viewer on the machine, but it is a bugger to dig out. I'm currently in the process of making a full SQL database driven web GUI to track logins... Taking abit longer than I wanted so it can't help you here i'm affraid

[FN-GM]

I don’t think that will help in this case as he wanted to see who was logged on in the past.

[Stuart_C]

If you've got local profiles on the machine then do a search for "NTUSER.dat" (It's hidden, and not NTUSER.DAT.Log) in documents and settings.

It will tell you the last time a user logged out of that machine.

[Geoff]

Also if you use folder redirection, check the application log for eventids that apply to that. It will mention the user name.

[richard.thomas]

Ah my bad. I didn't read that properly (sorry!!). You should be able to find this information in the event viewer. If you look through to that date in application you'll prob find a few entries that have the username. It may not show the actual login, but you should be able to determine who was using the computer.