On 2/7/08, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > Remember that if you have multiple DC's that the last logon is > registered on the DC they authenticated to and it doesn't replicate to > other DC's. There are scripts out there that will poll all the DC's and > give you that info but you have to put it together.
That's why I said: " Actually, you might want to put the Snare client on the workstations instead." That way you can capture logon events more directly. Of course, it means setting auditing for each of the workstations, but that's not terribly onerous, and the Snare client includes facilities for remote self-installation. Should be pretty painless, really. Kurt ~ Upgrade to Next Generation Antispam/Antivirus with Ninja! ~ ~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm> ~
