Comments on: How do i find which user was the last to log onto a PC in an AD Domain? http://itknowledgeexchange.techtarget.com/itanswers/how-do-i-find-which-user-was-the-last-to-log-onto-a-pc-in-an-ad-domain/ Thu, 23 May 2013 05:15:55 +0000 hourly 1 By: pjb0222 http://itknowledgeexchange.techtarget.com/itanswers/how-do-i-find-which-user-was-the-last-to-log-onto-a-pc-in-an-ad-domain/#comment-104854 pjb0222 Wed, 14 Mar 2012 16:30:36 +0000 #comment-104854 The most accurate method is to turn on event logging on the PCs to capture log in events and then check them.
- Pull security logs from each system
- Parse each machine’s security event log for log in events.
Remember, like all events, they roll off the log as it fills.
There are tools available that automate this or you can use MS command line tools and SysInternal tools to script yourself.

Alternatively…

To pull from AD is very messy and requires:
- Set event logging on all DCs to capture requried events
- Pulling last logged in time for IDs
- See which DC updated the attribute.
- Pull the security event log from each domain controller to parse and hope event has not rolled off the log
- Check time of ID last update time in event log and match to system IP address, if lots of events in short time this can be a best guess effort.
- Hope that the lease has not changed since the event was logged so you can query IP for machine name

]]> By: rechil http://itknowledgeexchange.techtarget.com/itanswers/how-do-i-find-which-user-was-the-last-to-log-onto-a-pc-in-an-ad-domain/#comment-102441 rechil Sat, 04 Feb 2012 05:28:36 +0000 #comment-102441 AD stores a user’s last logon time in the Last-Logon AD user object attribute. In 2003 there is an Ad object attribute known as “Last-logon-timestamp” which helps to store the approx value of the last logon time of a user. It is still possible to see value of last log for auser from MMC as AD & computers snap-in.’/ dnld mmc for XP and if necessary dnld the troubleshoot tools for AD or even u can use dsquery user tool for the purpose. OR u can use 3rd party tool

]]> By: gabe9527 http://itknowledgeexchange.techtarget.com/itanswers/how-do-i-find-which-user-was-the-last-to-log-onto-a-pc-in-an-ad-domain/#comment-102419 gabe9527 Fri, 03 Feb 2012 15:25:59 +0000 #comment-102419 Have you checked the event viewer and see if what you are after is under security?

]]>