General discussion

Locked

User logon time "history"

By jtra ·
Hi,

I have been asked by management to find out whether a particular user has truly and honestly logon to the network on a particular day.....due to security reason.

How do I obtain information of such a user from Windows NT server as in logontime, log off time etc.

Is there any third party sofware that enable me to obtain such information?

Please help.

Thank you in advance.

regards,
Jimmy

This conversation is currently closed to new comments.

7 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

User logon time "history"

by jtra In reply to User logon time "history"

The question was auto-closed by TechRepublic

Collapse -

User logon time "history"

by Joseph Moore In reply to User logon time "history"

Yes, you can pull the last logon time from the SAM database; just do the following at a command prompt:

NET USER "username" /DOMAIN

But it sounds like you need to pull this info from sometime in the past, and THAT is where things become more difficult. You see, this Last Logon is over-written every time the user logs in, so if you need to see if they logged in on Oct 31, and they have logged in since then, then this won't help you.

Do you audit Successful Logons on your PDC? Because that is where the historical info you need is kept, in the Event Viewer Security Log.

Open up the Security log on your PDC and look for Event ID 528. That is the Successful Logon event. If you have them in the log, then you are auditing the successful logons.
If not, then there isn't much help that can be offered.

You can start auditing Successful and/or Failed logon attempts by opening User Manager for Domains on the PDC, then click on Policies ->Audit.
Then, click the Successful and/orFailure checkboxes for Logon and Logoff. Then click OK.

From that time on, whatever you select to audit will be in the Security Log.

hope this helps

Collapse -

User logon time "history"

by jtra In reply to User logon time "history"

The question was auto-closed by TechRepublic

Collapse -

User logon time "history"

by #aix! In reply to User logon time "history"

You could put a line in the login script to append a file somewhere on the network with a timestamp. This would produce a file that kept a running history of the user's login times, though I would not put the file somewhere that the user had easy access too.

Collapse -

User logon time "history"

by jtra In reply to User logon time "history"

The question was auto-closed by TechRepublic

Collapse -

User logon time "history"

by jtra In reply to User logon time "history"

This question was auto closed due to inactivity

Back to Windows Forum
7 total posts (Page 1 of 1)  

Related Discussions

Related Forums