Re: How to find out what computer a user logged in on.

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 04/21/05 

Date: Thu, 21 Apr 2005 15:02:25 -0500

For a domain your best bet is to enable auditing of logon events in Domain
Controller Security Policy and for domain computers enable auditing of logon
events in Domain Security Policy. Be sure to increase the size of your
security log quite a bit on your domain controllers to sat at least 10MB.
You would then have to look in the security logs of the domain controllers
to see the user name and account logon events. There would also be a logon
event recorded on the domain computer where they logged on though that would
be more difficult to find though the free tool Event Comb can scan the logs
of multiple computers for specific events or text strings such as a user or
computer name. If you have at least one Windows 2003 domain controller you
can use the new limitlogon RK tool to track user logons. The link below may
help. -- Steve

http://www.microsoft.com/technet/security/prodtech/windows2000/secmod144.mspx
http://www.thincomputing.net/newsitem296.html -- limitlogon info and FAQ
link

<Atlanta Thrashers Fan> wrote in message
news:95vf61hc3cod07uq8hp2s8vk7uigf5m238@4ax.com...
> I need to know how to find out what computer a user logged in on.
> I've looked in the Security Event Log, and I see there's a field for
> it. But, there's no information in that field. It's almost always
> blank.
> Also, how can I find out what computer(s) a user is currently
> logged in on? I have the Windows 2000 Resource Kit, but I haven't
> seen a tool in there that will tell me. Any help you can give is
> greatly appreciated.

Relevant Pages

  • Re: Unusual logon / logoff Security event log
    ... I researched the MPS Report but didn't find the Security log. ... Click Services tab and select Hide All Microsoft Services and Disable ... and a logon GUID. ...
    (microsoft.public.windows.server.sbs)
  • Re: How to find out what computer a user logged in on.
    ... > For a domain your best bet is to enable auditing of logon events in Domain ... > Controller Security Policy and for domain computers enable auditing of logon ... > events in Domain Security Policy. ... If you have at least one Windows 2003 domain controller you ...
    (microsoft.public.win2000.security)
  • Re: IIS6 prompting for username and password
    ... Security log was full. ... > Logon Failure: ... > Caller User Name: NETWORK SERVICE ...
    (microsoft.public.inetserver.iis.security)
  • Re: tracking users login and logoff
    ... With PRO you can use Local Security Policy (Control Panel, ... Audit Account Logon Events Success and/or failure) ... Start, Run, Eventvwr.msc and look in the Security Log. ...
    (microsoft.public.windowsxp.customize)
  • Re: Event Viewer
    ... network" user right in Local Security Policy and reboot. ... error message on his computer when the application/process that needs authentication ... > Successful Network Logon: ... I seem to get an entry in my Security Log every time he ...
    (microsoft.public.win2000.security)