Tracking user activity

  • Thread starter Thread starter Brandon
  • Start date Start date
B

Brandon

I have a user who states they forgot to clock in in the
morning but they came in at x:xxAM. Is there anyway to
see when activity began on their PC to see if they are
lying? Thanks!
 
The last modified date of ntuser.dat will be one clue.
The uptime of the machine.
If you audit successful logons, see the security event log.

Three things of probably many.

Ray at work
 
uptime.exe is a Resource Kit utility that you use from the command line as:

uptime \\machinename

Ray at work
 
Ray at said:
The last modified date of ntuser.dat will be one clue.
The uptime of the machine.
If you audit successful logons, see the security event log.
Click to expand...

NTUSER.DAT is updated every few minutes during a session, so that won't
help here. The date and time on pagefile.sys will be the last time the
system was booted. If the user doesn't shut doemn the machine at night
and start up in the moring, that doesn't help either. My machine at home
has been up for five days. The one at work has been up for about 3
months. I can't find anything standard in Win2K that naturally holds the
date and time of the last login.
 
Back
Top