Re: Finding Out when last log in was

Well, there is a distinction between logging off but leaving the computer
running and shutting down a computer altogether.

If the computer was shut down, go to Administrative Tools/Event
viewer/System log. Every time a computer starts up you will get 2
Information/Source: Event log events at the same time - Event ID: 6009 and
6005.

If the user merely logged off and left the computer running, you could track
these events in the Security log, but only if you had enabled auditing. If
this is an AD domain and you enabled account logon auditing, you could view
the events in the Security log on the Domain Controller.

Doug Sherman
MCSE, MCSA, MCP+I, MVP



"Teo" <Teo@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:D3320D0B-62C1-4392-98F9-133E51530373@xxxxxxxxxxxxxxxx
> HI,
> I have a user who believes he logged off the last time he was on his
> computer but came back and it was logged in as him. Where would i look to
> verify what time the computer was last logged on? Is there a place to
view
> when a start up process last booted or a file which is overwritten?
>
> Thank You,
> Matt


.

Relevant Pages

  • Re: account lockout fails
    ... In my domain controller security log I received the following events ... Address is the workstation IP address. ... each other in the security log until there were a total of 24. ... domain lockout policy did not take effect and lock the account. ...
    (microsoft.public.win2000.security)
  • Re: security event logs in DC as well ? SOS
    ... I don't know how you are seeing duplicate events because what is recorded in ... computer/user attempts to access the computer either via interactive logon ... event recorded on a domain controller at the sane time as you see a logon ... security log of a domain controller as account logon attempts. ...
    (microsoft.public.windows.server.security)
  • SeSecurityPrivilege failure
    ... When I run a notification query in the root\cimv2 namespace using Wbemtest ... In the security log I see two ... The machine on which I am running this query is the only domain controller ...
    (microsoft.public.win2000.advanced_server)
  • WMI: Access Denied. SeSecurityPrivilege failure.
    ... When I run a notification query in the root\cimv2 namespace using Wbemtest ... In the security log I see two ... The machine on which I am running this query is the only domain controller ...
    (microsoft.public.win2000.security)
  • Re: Audit Logon Failures
    ... > success and failure in Domain Controller Security Policy. ... > auditing of logon events for the domain computers. ... > size of your security log quite a bit from default to at least 10MB. ...
    (microsoft.public.security)