Who has logged into Windows Server 2003?

Question

I would like to know in the past who has logged into a particular Windows Server 2003 machine. In Linux, I would use the command "last", and I would like similar information: username, source (IP address), start time, and either length or end time.

Most users log in using terminal services, but some use the console.

Answer 1

Various ways. Your event logs can track a variety of logon/logoff events but you should be able to narrow them down based on the ID number.



IF that doesn't work, there are several other tricks you can use:

1. From a command prompt, type:

dir "%userprofile%\..\ntuser.dat" /ah /s

this will list the last time for each user that their user registry settings were modified.



2. Create a login script that notes the user name and logon time to a network share accessible to all:

echo %username% - logon at %date% %time%>>\\server\share\logon.log



(There are a variety of ways to do this with a logon script).

Answer 2

event log

Answer 3

event viewer... audit logs? not posative but its a start if logging is enabled.