There is not built in way to find out currently logged on users without
using a third party tool or implementing the cconnect Resource Kit tool on
the domain that requires a client component on each computer and the use of
a SQL server. There is a free PsLoggedOn utility from SysInternals that may
be of some help.
http://www.sysinternals.com/ntw2k/freeware/psloggedon.shtml -- PsLoggedOn
You can enable auditing of account logon events in Domain Controller
Security Policy to find when users have logged onto the domain and audit
logon evnts on domain computers to find out when any user has logged on
locally to a domain computer. See the link below for more info on auditing.
Be sure to read the part on using Event Comb to scan remote computer logs
for needed events or text searches. Account logon events will be recorded on
the domain controller that authenticates the user and computer names may be
recorded instead of IP addresses but you shoould be able to ping a computer
by name if it is turned on the find the IP address or look in the wins, dns
zones, and dhcp leases for possible IP to name mappings.
http://www.microsoft.com/technet/security/guidance/secmod144.mspx
There is also a free tool from Somar Soft that will give you a list of users
and last time they logged on called Dumpsec. Take a look at the reports for
users and the options you can add to the report. --- Steve
http://www.somarsoft.com/
