RE: how can I see when the last time it was when a computer loged on

Hello Customer,

Thank you for posting here. Let's also thank Lanwench for the input.

According to your description, I understand that you want to monitor the
client computers logon domain event. If I have misunderstood the problem,
please don't hesitate to let me know.

Based on my research, I suggest we try the following steps to see if we can
resolve this issue:

You can try to enable the policy "Audit logon events" and then we can audit
the user logon/logoff events in the security log.

To enable the policy "Audit logon events", please perform the following
steps:

1. Logon SBS using domain administrator. Extend Advanced Management->Group
Policy Management->Forest: domain.local->Domains->domain.local
2. Open default domain controller policy or create a new GPO at domain
level.
3. Click Local Computer Policy, click Computer Configuration, and then
click Windows Settings->Security Settings->Local Policies->Audit
Policy->Double click Audit logon events and Audit Account Logon
Events->Select Success and Failure. Click OK.

You can find the following information from the Windows Server 2003
Security Guide:

Audit Account Logon Events

Determines whether to audit each instance of a user logging on to or
logging off from another computer in which this computer is used to
validate the account. If you define this policy setting, you can specify
whether to audit successes, audit failures, or not audit the event type at
all. Success audits generate an audit entry when an account logon attempt
succeeds. Failure audits generate an audit entry when an account logon
attempt fails.

If success auditing for account logon events is enabled on a domain
controller, an entry is logged for each user who is validated against that
domain controller, even though the user is actually logging on to a
workstation that is joined to the domain.

Audit Logon Events

Determines whether to audit each instance of a user logging on to, logging
off from, or making a network connection to this computer. If you are
logging successful account logon audit events on a domain controller,
workstation logon attempts do not generate logon audits. Only interactive
and network logon attempts to the domain controller itself generate logon
events. In short, "account logon events" are generated where the account
lives; "logon events" are generated where the logon attempt occurs.

If you define this policy setting, you can specify whether to audit
successes, audit failures, or not audit the event type at all. Success
audits generate an audit entry when a logon attempt succeeds. Failure
audits generate an audit entry when a logon attempt fails.

Windows Server 2003 Security Guide
http://www.microsoft.com/downloads/details.aspx?FamilyID=8a2643c1-0685-4d89-
b655-521ea6c7b4db&displaylang=en

After you ensure the policy, restart the client computer to apply the
policy. Then, if the client computer success logon domain, you will find
the following security event log on SBS:

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 12/12/2007
Time: 5:21:00 PM
User: NT AUTHORITY\SYSTEM
Computer: SBSSERVER
Description:
Successful Network Logon:
User Name: SBSSERVER$
Domain: SBSC
Logon ID: (0x0,0x8372A62)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:
Logon GUID: {35492017-76e5-55e1-64f9-96d6ffda21cf}
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 127.0.0.1
Source Port: 51381


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I hope these steps will give you some help.

Thanks and have a nice day!

Best regards,

Terence Liu(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
| Thread-Topic: how can I see when the last time it was when a computer
loged on
| thread-index: Acg8B1h64VV9HCp9SW+/SRtlhTOu0w==
| X-WBNR-Posting-Host: 207.46.192.207
| From: =?Utf-8?B?UmFscGg=?= <Ralph@xxxxxxxxxxxxxxxxxxxxxxxxx>
| Subject: how can I see when the last time it was when a computer loged on
| Date: Tue, 11 Dec 2007 07:06:02 -0800
| Lines: 8
| Message-ID: <A6C94E0E-07CA-43C9-A127-EDB944A99C50@xxxxxxxxxxxxx>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
| Newsgroups: microsoft.public.windows.server.sbs
| Path: TK2MSFTNGHUB02.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:81308
| NNTP-Posting-Host: tk2msftibfm01.phx.gbl 10.40.244.149
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| Hello,
|
| how can I see what te last time is was when e computer loged on to a
domain.
| I want to clean up some computers
|
| but I can't find ou how to see some last logon dates.
|
| anyone ?
|

.

Relevant Pages

  • Re: Benutzerkonten oft gesperrt !!!
    ... Wie heißt auf deutsch "account logon events" und "logon events"? ... Configuring Audit Policy ... you don't use User Manager to enable auditing in Win2K. ...
    (microsoft.public.de.german.win2000.active_directory)
  • RE: find on which computer is connected a user
    ... i dones'nt want if possible to enable Audit Logon Events ... You may try to enable the policy "Audit Logon Events" and then audit the ... Limit concurrent connections per user. ...
    (microsoft.public.windows.server.general)
  • RE: find on which computer is connected a user
    ... You may try to enable the policy "Audit Logon Events" and then audit the ... Write events to the event log of a specified server concerning the status ...
    (microsoft.public.windows.server.general)
  • Default Domain Policy vs. Default Domain Controller Policy
    ... to enable the Audit Accounts Logon Events and the Audit Logon Events ... that the policies are configured to audit both successes and failures. ...
    (microsoft.public.cert.exam.mcsa)
  • Default Domain Policy vs Default Domain Controller Policy
    ... to enable the Audit Accounts Logon Events and the Audit Logon Events ... that the policies are configured to audit both successes and failures. ...
    (microsoft.public.cert.exam.mcse)