User logon time

prospect

Anyone know how to check what time a user logged onto their machine?

Workstation is Win XP Pro
Server is Win 2003 Server with active directory

No e-mail installed for the particular user.

Cheers,
P

onechewy

By checking out Event Viewer on the users PC, you can see what time certain services started on the PC (eg AV autoprotect) which will let you know roughly what time someone logged on. Not exact, but it's quick.

sebastianlieken

open a command window by going to start - run - type 'cmd' and press ok (a black window will come up), type in 'systeminfo' into the black window and press enter. scroll to the very top of the black window when the information pops up. roughly 10 lines from the top will be a line that says 'system up time:' which will you how long the pc has been turned on.....if that helps

seamus

Depending on the setup, the logon may have been recorded in the event log of the domain controller.

Ginger

Enable auditing on the computer and audit login and logout events, you can then check them in the event logs

prospect

Problem is that the machine is now logged out, so I assume the Event Viewer and CMD Prompt options will not hold retrospective information.

I looked at the Event Log on the Server, under security, it only gives load of Logon/Logoff events for the machine in question which appear several times all through the night since yesterday. Also, they only log events on the machine, it does not specify what user was logged in.

I need to know what time it was initially logged in this morning, by a particular user.

Ginger

Ok, this is post event checking rather than seeing how to do it for future events.

Check the last modified date of the NTUSER.DAT in the local Documents And Setting directory, this will possibly tell you when they last logged off

seamus

The only other option then, if it's been set up, is the security log on the machine itself. I don't think security auditing is set up by default though.

Capt'n Midnight

In the future you can add a line to the logon script
echo %date% %time% >> \\server\share\%username%.txt
not very secure in the sense that it don'r prove anything since it can be altered but handy

check out the temp folder in the users profile, you may be able to see when they opened the first email today or look at sent item / read receipts

prospect

Thanks for all the help guys.

P