Re: Missing PC - Want to know who last logged on
- From: "Al Dunbar" <AlanDrub@xxxxxxxxxxxxxxxxxxx>
- Date: Thu, 28 Jun 2007 18:02:30 -0600
"Hugh" <Hugh@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:15C2B295-CC9B-4803-879B-18B12F6ECB1D@xxxxxxxxxxxxxxxx
We have a PC that is missing. It is a domain-based PC on a Win 2003
domain.
I have all security event logs from all domain controllers, but no access
to
the missing PC's event logs. I also have access to SMS. In the event
logs,
I have found several entries for the PC, but can't figure out how to
determine who last logged on. Is it possible without the PC's event logs?
Or with SMS? Thanks.
I think you're out of luck, sorry.
The DC's don't keep track of where a person logs in from. And, while SMS may
indicate who was logged in when it last did a software or hardware scan, I
am almost completely positive that it does not log login events on the
workstations.
You should be able to determine within a week or so when it was last
actually present on your network. Check the modified date for the computer
account, and also the last password change date. Passwords for computer
accounts are changed regularly, and this is reflected in both active
directory and on the actual client computer. The process is done through
some handshaking between the computer and the DC, so you will know that the
computer was "present" on the date the account's password last changed.
/Al
.
- Prev by Date: how to modify Enterprise RootCA + CertificateTemplates for "EV"-security/green-bar
- Next by Date: Re: Missing PC - Want to know who last logged on
- Previous by thread: how to modify Enterprise RootCA + CertificateTemplates for "EV"-security/green-bar
- Next by thread: Re: Missing PC - Want to know who last logged on
- Index(es):
Relevant Pages
|
