Who had access

  • Thread starter Thread starter JohnD
  • Start date Start date
J

JohnD

Is there a way to show who had access or logged onto a PC
for the last 3 months?
Thanks
 
That information will be store in the 'Security Event
Log'. That can be accessed via Computer Management.
However, the length of time that it spans will vary
depending upon the setting for that log. Right-Click on
the 'Security Event Log' and under 'Properties' you will
see how it is set up and how far back it is storing data.
In the Event Viewer, a user logon is identified with an
Event ID of '540' indicates a USER Logon.

This should get you started, good luck.
Patrick Cohan
 
It's also there, but you have to turn on logon auditing first. If it
wasn't turned on during the period you're interested in, it's too late.
 
Back
Top