Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


xpd



SysOp
10259 posts

Uber Geek

Mod Emeritus
Trusted
Lifetime subscriber

# 143070 2-Apr-2014 15:12
Send private message

Im more desktop rather than server else Id probably know this... :)

I need to find the logon history of a particular user, going back far as AD logs will let me - Ive had a look at quite a few different auditing tools but they either wont run, or dont offer me what I need.
I've been told to look at dsquery, which I have done, but makes little sense to me at the moment......

Can anyone give me a quickfire way of getting the information I need or am I stuffed ? :)

I have full access to the server/AD.


TIA





XPD / Gavin / DemiseNZ

 

Server : i5-3470s @ 3.50GHz  16GB RAM  Workstation : Ryzen 5 3600 / 16GB DDR4 / RX580 4GB    Console : Xbox One

 

Now on BigPipe 100/100 and 2Talk  Add me on Steam   My Lego

 

Current Projects : Arcade Machine          BBS (WIP)


Create new topic

gjm

755 posts

Ultimate Geek


  # 1017275 2-Apr-2014 15:23
Send private message

I use EventCombMT for troubleshooting lockouts, sure you could do the same for auditing logons...have a read here http://windowsitpro.com/systems-management/take-advantage-eventcombmt-utility

M
y domain is 2003...not sure if it works on 2008 or 2012




[Amstrad CPC 6128: 128k Memory: 3 inch floppy drive: Colour Screen]

3947 posts

Uber Geek

Trusted
Lifetime subscriber

  # 1017292 2-Apr-2014 15:51
Send private message

Pretty sure your screwed for historical purposes, unless the organisation has actively setup auditing of logon events.

Off the top of my head I'd imagine that going forward you could rig something up. Enable success audit logging on every DC, and forward the events to a central location.. 




Information wants to be free. The Net interprets censorship as damage and routes around it.


 
 
 
 


xpd



SysOp
10259 posts

Uber Geek

Mod Emeritus
Trusted
Lifetime subscriber

  # 1017353 2-Apr-2014 16:41
Send private message

Yeah, I'm thinking that. All these tools Ive downloaded today claim they can do it yet none have been able to....  oh well, looks like this project is going in the bin for now.






XPD / Gavin / DemiseNZ

 

Server : i5-3470s @ 3.50GHz  16GB RAM  Workstation : Ryzen 5 3600 / 16GB DDR4 / RX580 4GB    Console : Xbox One

 

Now on BigPipe 100/100 and 2Talk  Add me on Steam   My Lego

 

Current Projects : Arcade Machine          BBS (WIP)


78 posts

Master Geek


  # 1017485 2-Apr-2014 19:51
Send private message

What exactly are you trying to audit?
Windows natively is messy in tracking this.
Local logons may not be tracked so easily
With domain logons you could setup a powershell script that queries event logs of each DC in your environment for a logon type event.
You may need to be more particular with your time frames as DCs generally generate allot of logs and may not keep logs for long unless specified otherwise.

If you have Altiris or other database collection software you could look at authentication logs from there.

xpd



SysOp
10259 posts

Uber Geek

Mod Emeritus
Trusted
Lifetime subscriber

  # 1017635 3-Apr-2014 08:30
Send private message

Trying to get historical login times for a user (When did they log into the office PC in the past few weeks/months ) - but appears going backwards is something Windows AD logging dosent do so well :) (Funny... MS Windows seems to go backwards every few release without an issue)

Ive got 1.5hrs left to find a solution ;)





XPD / Gavin / DemiseNZ

 

Server : i5-3470s @ 3.50GHz  16GB RAM  Workstation : Ryzen 5 3600 / 16GB DDR4 / RX580 4GB    Console : Xbox One

 

Now on BigPipe 100/100 and 2Talk  Add me on Steam   My Lego

 

Current Projects : Arcade Machine          BBS (WIP)


Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Vodafone New Zealand starts two year partnership with LetsPlay.Live
Posted 28-Jan-2020 11:24


Ring launches indoor-only security camera
Posted 23-Jan-2020 17:26


New report findings will help schools implement the digital technologies curriculum content
Posted 23-Jan-2020 17:25


N4L to upgrade & support wireless internet inside schools
Posted 23-Jan-2020 17:22


Netflix releases 21 Studio Ghibli works
Posted 22-Jan-2020 11:42


Vodafone integrates eSIM into device and wearable roadmap
Posted 17-Jan-2020 09:45


Do you need this camera app? Group investigates privacy implications
Posted 16-Jan-2020 03:30


JBL launches headphones range designed for gaming
Posted 13-Jan-2020 09:59


Withings introduces ScanWatch wearable combining ECG and sleep apnea detection
Posted 9-Jan-2020 18:34


NZ Police releases public app
Posted 8-Jan-2020 11:43


Suunto 7 combine sports and smart features on new smartwatch generation
Posted 7-Jan-2020 16:06


Intel brings innovation with technology spanning the cloud, network, edge and PC
Posted 7-Jan-2020 15:54


AMD announces high performance desktop and ultrathin laptop processors
Posted 7-Jan-2020 15:42


AMD unveils four new desktop and mobile GPUs including AMD Radeon RX 5600
Posted 7-Jan-2020 15:32


Consolidation in video streaming market with Spark selling Lightbox to Sky
Posted 19-Dec-2019 09:09



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.