|
Posted by Hugh on June 29, 2007, 12:30 am
Please log in for more thread options Sounds good. Thanks again.
--
Hugh
"Al Dunbar" wrote:
> for future use, there are commandline tools available for extracting the
> date of last logon for all profile owners on a remote system, here is one:
>
> http://www.microsoft.com/technet/sysinternals/Security/PsLoggedOn.mspx
>
> If theft is a significant problem for you, you could schedule a nightly job
> to collect this from your workstations. If it found one missing, it could
> send the previous night's report for that workstation to an admin.
>
> Alternately, you could log each session into a log file from your logon
> script, and then run a job to process the logs.
>
> Neither will prevent theft, but either could help identifying when it might
> have happened, and providing some evidence about who might have been around
> at the time. Actually, the logon script approach would pin this down much
> more accurately.
>
> /Al
>
> >I was afraid of that. Thanks for the reply and the tips.
> > --
> > Hugh
> >
> >
> > "Al Dunbar" wrote:
> >
> >>
> >> > We have a PC that is missing. It is a domain-based PC on a Win 2003
> >> > domain.
> >> > I have all security event logs from all domain controllers, but no
> >> > access
> >> > to
> >> > the missing PC's event logs. I also have access to SMS. In the event
> >> > logs,
> >> > I have found several entries for the PC, but can't figure out how to
> >> > determine who last logged on. Is it possible without the PC's event
> >> > logs?
> >> > Or with SMS? Thanks.
> >>
> >> I think you're out of luck, sorry.
> >>
> >> The DC's don't keep track of where a person logs in from. And, while SMS
> >> may
> >> indicate who was logged in when it last did a software or hardware scan,
> >> I
> >> am almost completely positive that it does not log login events on the
> >> workstations.
> >>
> >> You should be able to determine within a week or so when it was last
> >> actually present on your network. Check the modified date for the
> >> computer
> >> account, and also the last password change date. Passwords for computer
> >> accounts are changed regularly, and this is reflected in both active
> >> directory and on the actual client computer. The process is done through
> >> some handshaking between the computer and the DC, so you will know that
> >> the
> >> computer was "present" on the date the account's password last changed.
> >>
> >> /Al
> >>
> >>
> >>
>
>
>
| 
XML Sitemap