In order to get accurate results, you will need to query all of the domain controllers in your domain (assuming w2k domain or higher). You could try an eval of Hyena - it will do this for you. Keep in mind, this is going to cover all logons, some of which may happen overnight if the user keeps their machine turned on and logged into. The DC's are also not going to log any interactive logins - you would have to check the event logs on the machine in question for that. All of the logon types on the DC's will show as logon type 3 (network logon) unless the user is actually logging on to the DC. Better yet, if you have access to the computer(s) the user logs on to, you can just check the event logs on that for a 528 or 540 with a logon type of either 2 (interactive) or 7 (unlock).
James Winzenz Infrastructure Systems Engineer II - Security Pulte Homes Information Services ________________________________ From: Naresh Kumar [mailto:[EMAIL PROTECTED] Posted At: Thursday, July 31, 2008 8:05 AM Posted To: AD Issues Conversation: Last Logon Subject: Last Logon ~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK Test! ~ ~ ~ CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by email and delete the message and any file attachments from your computer. Thank you. ~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK Test! ~ ~ <http://www.sunbelt-software.com/product.cfm?id=400> ~
