Login History

[fil_b]

I am after a set of login histroy to find out what user has defaced laptop keyboard

 

What the easyest way to track this??

 

Is there anywhere that stores what user has logged in on what machine??

 

I have the name of the machines but i need to find the users who logged in

 

Thanks

 

Fil

[MaximusR]

Hi Fil,

 

If you go to the Event Viewer, in Computer Manager and select Security you should be able to view who has logged on to and off the machine.

 

Hope this helps,

 

Maximus R

[fil_b]

Hi Fil,

 

If you go to the Event Viewer, in Computer Manager and select Security you should be able to view who has logged on to and off the machine.

 

Hope this helps,

 

Maximus R

 

 

hi Maximus

 

I have checked the 2 machines but there is only one entry going back to 2007

 

any other places?? servers or anything?

 

tar

 

Phil

[actech]

This is of no comfort to you now but I recommend that you use a script to record who logs and where. The thread linked below details a script that I am now using and have caught a few kids out now

 

Record Logon

[K.C.Leblanc]

Have a look in c:\documents and settings for cached profiles. You might find the last modfied date of one of the files will give you a clue.

 

It you have a printer setup you might also want to have a look on your print server since if they printed anything.

 

For future reference you might want to add something along the lines of "echo %USERNAME% %TIME% %DATE% >> [some secret location]\%computername%.txt" to your logon script.

 

Also get papercut logger (it's free) and will log all print jobs.

[sted]

Have a look in c:\documents and settings for cached profiles. You might find the last modfied date of one of the files will give you a clue.

 

It you have a printer setup you might also want to have a look on your print server since if they printed anything.

 

For future reference you might want to add something along the lines of "echo %USERNAME% %TIME% %DATE% >> [some secret location]\%computername%.txt" to your logon script.

 

Also get papercut logger (it's free) and will log all print jobs.

 

i tend to use a slightly different script as i find that some pcs for no obvious reason log time with fractions of a second and some dont making the data a swine to compare in excel later so i add a mytime variable and dump that instead

 

echo -------Log user access to Machine-------
set mytime=%TIME:~0,-3%
echo %username%,%computername%,%mytime%,%date% >> \\server\userlog$\userlog.txt

[SpuffMonkey]

Our script dumps to a database - with a nice little web based query front end - makes searching this stuff down nice & easy

[fil_b]

looked in docs and settings - profiles are couple days out

 

Will need to look at setting something up

 

Thanks

[MaximusR]

Hi Phil,

If the laptop is connected to wireless you may have a wireless access log somewhere? Access Point, RADIUS server etc. Or you could look at the event viewer on the domain controller?

 

Maximus R