Who had access

[JohnD]

Is there a way to show who had access or logged onto a PC
for the last 3 months?
Thanks

 

[Patrick Cohan]

That information will be store in the 'Security Event
Log'. That can be accessed via Computer Management.
However, the length of time that it spans will vary
depending upon the setting for that log. Right-Click on
the 'Security Event Log' and under 'Properties' you will
see how it is set up and how far back it is storing data.
In the Event Viewer, a user logon is identified with an
Event ID of '540' indicates a USER Logon.

This should get you started, good luck.
Patrick Cohan

 

[JohnD]

Thanks Patrick, how about if it was accessed over the
network?

 

[Ricardo M. Urbano - W2K/NT4 MVP]

It's also there, but you have to turn on logon auditing first. If it
wasn't turned on during the period you're interested in, it's too late.