How to tell who last logged into a netbook

[kaphc]

One of our netbooks has gone AWOL, and despite urging all the teachers to have a look for it in their classrooms (and standing there to make sure they do!) it ain't turning up.

 

I would love to be able to find out who last logged into it as this would show up which class to look in.

 

I've tried AD Users & Computers and found the last login event was the 8th March - doesn't say who though.

 

Is there any way to find out a username?

[kaphc]

Well, have trawled through Event Viewer for the logons between the two time stamps on the netbook object and there's nothing coming up linking it with a user sadly.

[Admiral208]

what do you use for internet filtering? are there any logs in that you can look at? chances are if they went on the netbook, it would have connected to the internet and could have left a clue?

[sted]

dosent ad record that in an attribute somewhere i think its hidden by default but i think its logged

[mac_shinobi]

run a constant ping each day on the computer name the netbook had to see if its brought back in , if so you can go from there and query the computer to find out a logged on username ?

 

Otherwise it's been stolen possibly ?

[kaphc]

dosent ad record that in an attribute somewhere i think its hidden by default but i think its logged

 

Have trawled through the attributes Tab and could only find the last login time and stamp ... no user name. Googling it has brought up various ways of implementing scripts etc for the future if we want to do that, but otherwise has drawn a blank. It just seems to be something that AD doesn't record, unless I've missed it.

 

Otherwise, yeah, maybe it has been filched. Still think it's a teacher in a hurry who's put it somewhere and lost it though. Hope so anyway.

[CyberNerd]

Does it have centrally managed antivirus? McAfee certainly allows you to see who last logged in.

 

Otherwise disable the machine from AD. If its still being used in school someone will bring it back if they can't log in.

[kaphc]

The internet filtering won't be a goer, we're on the embc services and should in theory have access to the Netsweeper filtering but in practice primaries don't seem to get much access.

 

We're on Symantec Endpoint Protection and that's rolled out via a central management tool so I'll have a look and see tomorrow. Good idea.

[FN-GM]

Probably not much help now but this could help you log who logged in where for if it happens again

 

http://www.edugeek.net/forums/how-do-you-do/92142-who-has-logged-where.html#post804369

[glennda]

You don't use FOG do you?

[RageRiot]

you have to turn logon auditing on to capture logon events from users which you can do per ou even. this wil only help going forward though should it ever happend again.

 

HOW TO: Audit Active Directory Objects in Windows Server 2003

[kaphc]

Does it have centrally managed antivirus? McAfee certainly allows you to see who last logged in.

 

Otherwise disable the machine from AD. If its still being used in school someone will bring it back if they can't log in.

 

And Symantec came to my rescue and showed the kid who last logged in. Wasn't at work Tues/Weds so have "named and shamed" today and will see how the teachers respond. Someone's going to be turning their classroom upside down today I think.

Edited March 22, 2012 by kaphc