Last machine logon

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

How can I determine the last time a machine account authenticated to an
Active Directory (Windows 2003 DCs) Domain?
 
Not too au-fait with Server 2003, but in earlier versions logons were
security event-log entries. I imagine they still are.
 
I believe by default that auditing of account logon events is enabled in
Windows 2003 so you could try searching the security logs for the name of
that domain computer and the free Event Comb from Microsoft makes that
pretty easy by allowing you to search for specific Event IDs and text
strings such as computer names but realize in the security logs that
computer names have $ in front of the name to distinguish them as a computer
account. You may also look at using the Active Directory Command line tools
such as dsquery computer -inactive NumberOfWeeks that can help identify
computer accounts that have not been used in a while. Also there is a free
tool from http://www.joeware.net that may be able to do what you want. See
the second link below.

Steve

http://technet2.microsoft.com/Windo...43fd-4985-b429-cd53d3046f011033.mspx?mfr=true
http://www.joeware.net/win/free/tools/oldcmp.htm
 
Back
Top