Pretty sure you have to enable Auditing of successful
logon events in Group Policy. Then review this in the
Event log.
It has to be enabled when the user log's on to do this so
you wont be able to see old logon events.
In addition to what both Simon and Kev posted, please note
that there are a couple of nice utilities out there that
can help you. Take a look at the following two web sites:
Just go to the Free Win32 C++ tools and then look
at 'GetUserInfo'. As I have not actually used it myself (
well, not yet! ) I would assume that you would have to run
this against each DC in your environment.
You can set a Group Policy on the OU the computers are in.
It depends on which computers you want to monitor. If it's
the DC's then you will set the policy on the DC's OU. Or
you can set it at the Domain level, but this will record
every logon event in the network and obviously take up
resources. The log file will also be huge.
In addition to what both Simon and Kev posted, please note
that there are a couple of nice utilities out there that
can help you. Take a look at the following two web sites:
It is http://www.ladava.com. It is Matjaz's web site and
is in Slovenian. Simply click on the UTILITIES hyperlink
in the upper leftish corner and then click on the
UserAccountInactivity link ( sorry, can not remember what
it is called exactly ).
I believe that Matjaz wrote this with .net so it *MIGHT*
require .netFramework 1.1 be installed. However, not sure
about this! I have not yet used this, either.
Want to reply to this thread or ask your own question?
You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.
