I'm not sure how reliable this is, but I generally check the modified date on ntuser.dat under each profile directory. This would only work with local profiles I believe and could be circumvented if the user is so motivated. Does anyone know of problems with this method assuming the user isn't overly malicious?
|-----Original Message----- |From: Jose Guevarra [mailto:[EMAIL PROTECTED] |Sent: Tuesday, July 22, 2003 2:03 PM |To: [EMAIL PROTECTED] |Subject: finding who has logged in on Win2k Pro | | |Hi, | | We have possibly had some type of incident at our work place. |I'd like to |know if it is possible to check and see the "User Login" |history on a Win2K |pro machine. Is this history log enabled by default? What are |some other |ways? | |thanx, | |-Jose G.- | | |--------------------------------------------------------------- |------------ |--------------------------------------------------------------- |------------- | | --------------------------------------------------------------------------- ----------------------------------------------------------------------------
