Re: Finding out who was logged in

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 09/29/05


Date: Thu, 29 Sep 2005 12:21:53 -0500

If auditing of logon events was enabled in Local Security Policy you could
check the security logs to see who was logged on and when. Even if it was
not enabled there may be events recorded in the logs to indicate computer
activity at particular times. If they share the same name but different
password that means that each user could only logon to their workstation
computer. You could also logon to the computers [do not logon with their
account] and use search with advanced options to search for files/folders
that were created or modified on the day in question and you may be able to
find some useful information that way particularly for files/folders listed
in the users profile folder which may include cookies and temporary internet
files. You could also put the hard drive from the computers into another
computer as a slave/secondary drive to do the same if you do not want to
startup the computers. --- Steve

"Jake 1977" <Jake1977@discussions.microsoft.com> wrote in message
news:18CA7CEA-2261-4073-A15C-D45FF3A5A314@microsoft.com...
> Hello, we have a small Workgroup here at our office. I'm not really
> familiar
> with Workgroups, as I maintain the Domain that we use company-wide.
>
> All of the users in the Workgroup share the same username (administrator),
> but they each have their own password.
>
> An issue has come up where we need to see who was logged into one of the
> computers yesterday. Does anyone have an idea of how we can do this?
>
> I'm totally stumped, but perhaps someone out there has an answer.
>
> I appreciate any help you can offer.....thanks!!
>
> Jake



Relevant Pages

  • Re: Making the case for not installing DCs on remote sites (2xT1 links)
    ... 25,000 users;-) and I don't know how may servers -4,000 perhaps. ... I think that the logon ... >>>>to logon from branch offices where I have no DC+GC there. ... >>>>offices with more than 60 computers. ...
    (microsoft.public.win2000.active_directory)
  • Re: User Login
    ... the user account will be able to logon remotely even though they ... the domain group called Domain Users is a member of the local ... Users group on all computers; this is usually why any domain user can ... put those user accounts into domain group and apply a GPO to the OU ...
    (microsoft.public.windows.server.active_directory)
  • Re: Slow startup after logon
    ... the other computers are just my house computers. ... "John John" wrote: ... At school when you logon you are not connected to any other ... You can enable "verbose logging" and you might find out what ...
    (microsoft.public.windowsxp.general)
  • Re: GPO Policy Auditing Solution
    ... group policy that only applies to a specific group, users or computers. ... > within the Domain Controller's OU and enable account logon auditing in the ... enable auditing for logon events. ...
    (microsoft.public.windows.server.networking)
  • RE: client in Windows XP
    ... > I still cannot reproduce this issue on my own computers with Windows XP SP1 ... Logon with local Administrator. ... After logon, right-click the RDP file and select Edit, I can see the ... Please send me a screenshot of the exact screen when the issue ...
    (microsoft.public.win2000.termserv.clients)