NT security question

[eeshman]

I was wondering if anyone knows how to find out when the last time a user logged on to the network. I've checked the PDC Security logs and they only go back 2 days. The last person that worked in Network Management had set the security logs to overwrite after 5056K thus the logs only hold 2 days worth of info. Is there any other way to find out when a user logged in last?

-the eeshman

[jezter6]

If you have any other servers, you may want to check the logs of priveledge use on his/her home directory.

Also, if you have a mail server that keeps good logs (I have exchange), you can check the last time they used the mailbox.

[ammo]

The w2k Reskit (Nt reskit probably too) has a utility (script) called userstat if I remember right (the name) that lists the info you need....

Ammo

[eeshman]

Thanks for the tips guys. Helped tremedously. I did end up using the exchange server information.

-the eeshman

[jezter6]

w00t! hehehe...glad I could help.

[kenstcyr]

If they have a roaming profile, you can check the last time their NTUser.dat file was modified or look at the lastlogon.ini file in thier profile path.

.-=Ken=-.

[jezter6]

Yeah, I should have thought of that one too since we use roaming profiles. *yuck*

I'm trying to move away from them anymore, what a waste of server space and bandwidth.

Good post Ken!

[kenstcyr]

Thanks - I like to help where I can.

.-=Ken=-.

[ammo]

Originally posted here by jezter6
Yeah, I should have thought of that one too since we use roaming profiles. *yuck*

I'm trying to move away from them anymore, what a waste of server space and bandwidth.

Roaming profiles are good but you don't always need em..
(BTW, W2K profile syncrhonization algos are greatly improvide compared to NT4's)

Ammo

[bluenet]

don't speak! I wang hacking your computer!