Re: Missing PC - Want to know who last logged on



Hello,
"Hugh" <Hugh@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:15C2B295-CC9B-4803-879B-18B12F6ECB1D@xxxxxxxxxxxxxxxx
We have a PC that is missing. It is a domain-based PC on a Win 2003 domain.
I have all security event logs from all domain controllers, but no access to
the missing PC's event logs. I also have access to SMS. In the event logs,
I have found several entries for the PC, but can't figure out how to
determine who last logged on. Is it possible without the PC's event logs?
Or with SMS? Thanks.

when did SMS take the last snapshot?
In SMS Server 2003 I have a query Last Logon per PC with following query statement:

select SMS_R_System.Name, SMS_R_System.LastLogonUserDomain, SMS_R_System.LastLogonUserName, SMS_R_System.ADSiteName, SMS_R_System.IPAddresses, SMS_G_System_WORKSTATION_STATUS.TimeStamp from SMS_R_System inner join SMS_G_System_WORKSTATION_STATUS on SMS_G_System_WORKSTATION_STATUS.ResourceID = SMS_R_System.ResourceId

Maybe this can give you some more details.
Best greetings from Germany
Olaf

.



Relevant Pages

  • Re: Event ID 555 - Directory Service Access - Failure Audit
    ... No other errors are appearing in the event logs of ... Exchange is working without any issues. ... I am seeing this error in the Security Logs of the Domain Controllers. ... It's probably the RUS that's generating the failure when it tries to ...
    (microsoft.public.exchange.admin)
  • Re: Missing PC - Want to know who last logged on
    ... I have all security event logs from all domain controllers, ... I also have access to SMS. ... account, and also the last password change date. ...
    (microsoft.public.windows.server.security)
  • Re: user id to Domain admin group 3 months back-how to find who did it
    ... If you have enabled "Audit account management" on the domain controllers or in the domain policy, you can check the event logs. ...
    (microsoft.public.windows.server.active_directory)
  • Re: IIS tracking failed logins for users
    ... Check the Event Logs on your domain controllers. ... is used] If I use an invalid password in this case nothing gets logged, ... > I am using windows authentication for a web site hosted in IIS. ...
    (microsoft.public.inetserver.iis)
  • Re: Since upgrade of servers to 2003 network is slow
    ... What do you see in the event logs? ... > 4 of the servers are domain controllers the main domain controller has all ... > 2 of the other servers has the global catalogue installed. ... > I am having problems with at times a slow network and then at other times ...
    (microsoft.public.windows.server.active_directory)