User logon time "history"

Look at these:

http://www.jsiinc.com/SUBG/TIP3400/rh3410.htm

http://www.jsiinc.com/subc/tip1200/rh1252.htm

http://www.jsiinc.com/subg/tip3400/rh3437.htm

Yes, you can pull the last logon time from the SAM database; just do the following at a command prompt:

NET USER "username" /DOMAIN

But it sounds like you need to pull this info from sometime in the past, and THAT is where things become more difficult. You see, this Last Logon is over-written every time the user logs in, so if you need to see if they logged in on Oct 31, and they have logged in since then, then this won't help you.

Do you audit Successful Logons on your PDC? Because that is where the historical info you need is kept, in the Event Viewer Security Log.

Open up the Security log on your PDC and look for Event ID 528. That is the Successful Logon event. If you have them in the log, then you are auditing the successful logons.
If not, then there isn't much help that can be offered.

You can start auditing Successful and/or Failed logon attempts by opening User Manager for Domains on the PDC, then click on Policies ->Audit.
Then, click the Successful and/orFailure checkboxes for Logon and Logoff. Then click OK.

From that time on, whatever you select to audit will be in the Security Log.

hope this helps

You could put a line in the login script to append a file somewhere on the network with a timestamp. This would produce a file that kept a running history of the user's login times, though I would not put the file somewhere that the user had easy access too.

This question was auto closed due to inactivity