Finding out who was logged in

[Guest]

Hello, we have a small Workgroup here at our office. I'm not really familiar
with Workgroups, as I maintain the Domain that we use company-wide.

All of the users in the Workgroup share the same username (administrator),
but they each have their own password.

An issue has come up where we need to see who was logged into one of the
computers yesterday. Does anyone have an idea of how we can do this?

I'm totally stumped, but perhaps someone out there has an answer.

I appreciate any help you can offer.....thanks!!

Jake

 

[Steven L Umbach]

If auditing of logon events was enabled in Local Security Policy you could
check the security logs to see who was logged on and when. Even if it was
not enabled there may be events recorded in the logs to indicate computer
activity at particular times. If they share the same name but different
password that means that each user could only logon to their workstation
computer. You could also logon to the computers [do not logon with their
account] and use search with advanced options to search for files/folders
that were created or modified on the day in question and you may be able to
find some useful information that way particularly for files/folders listed
in the users profile folder which may include cookies and temporary internet
files. You could also put the hard drive from the computers into another
computer as a slave/secondary drive to do the same if you do not want to
startup the computers. --- Steve

 

[Guest]

Thanks for the information, Steven. I'll see what kind of damage I can do.

I really appreciate the quick reply!

If auditing of logon events was enabled in Local Security Policy you could
check the security logs to see who was logged on and when. Even if it was
not enabled there may be events recorded in the logs to indicate computer
activity at particular times. If they share the same name but different
password that means that each user could only logon to their workstation
computer. You could also logon to the computers [do not logon with their
account] and use search with advanced options to search for files/folders
that were created or modified on the day in question and you may be able to
find some useful information that way particularly for files/folders listed
in the users profile folder which may include cookies and temporary internet
files. You could also put the hard drive from the computers into another
computer as a slave/secondary drive to do the same if you do not want to
startup the computers. --- Steve

Hello, we have a small Workgroup here at our office. I'm not really
familiar
with Workgroups, as I maintain the Domain that we use company-wide.

All of the users in the Workgroup share the same username (administrator),
but they each have their own password.

An issue has come up where we need to see who was logged into one of the
computers yesterday. Does anyone have an idea of how we can do this?

I'm totally stumped, but perhaps someone out there has an answer.

I appreciate any help you can offer.....thanks!!

Jake