Reporting?

  • Thread starter Thread starter Shawn
  • Start date Start date
S

Shawn

Hello all,
I am hoping someone can help me out with this. I have been
asked today if I can find out what time a person logged out of their
system last Friday (April 22). Management thinks that this certain
person may have skipped out early and would like to try to confirm on
some level before having a talk with them. It would have been nice if
they would have asked me before 4:45PM today, but that's life I guess.
We are running AD on Win2K w/ SP4 and updated as of mid-March. We are
also running Exchange 2000 Std w/ latest SP and updates up to
mid-March as well. Thanks in advance for any ideas!

Shawn
 
Check on your Default Domain Controller Policy. Do you have auditing enabled
for 'audit logon events'? If so, you can check the security event log of
your DC and look for logoff events (ID 538). If not, dig out those CCTV
tapes and track the scoundrel down that way.
 
That's what I was afraid of. I did check the auditing and it is not
enabled. At least it wasn't as of yesterday. It is now. Thanks for
the info! I appreciate it.

Shawn
 
Back
Top