You can enable logon/logoff auditing. That will generate an audit event
whenever a user has logged on or off the domain. You can use eventcomb.exe
to query the event logs on all DCs for the user name and the logon event id
of 540. Eventcomb is included in the security tools kit at
http://www.microsoft.com/downloads/...FamilyID=9989D151-5C55-4BD3-A9D2-B95A15C73E92
--
Tim Hines, MCSE, MCSA
Windows 2000 Directory Services
=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.