Solved

Audit User log on

Posted on 2004-09-20
2
150 Views
Last Modified: 2013-12-04
I have a user who thinks he shut his computer off on Friday and when he came in Monday, his computer was logged in. I need to check if his login mane was used on Sunday. He is a domain user on a 2000 - 2003 domain. He has no security logs on his computer. On the domain controller there are security logs with messages for Sunday for various things. The problem is that there are many user names with these messages for Sunday. No one was here on Sunday. Are these messages normal even though no one is logging in and out? How can I check to see the last time this user logged in?

User Logoff:
       User Name:      userA
       Domain:            ABC
       Logon ID:            (0x0,0x387ED1D)
       Logon Type:      3

Special privileges assigned to new logon:
       User Name:      userA
                Domain:            ABC
       Logon ID:            (0x0,0x38AB692)
       Privileges:      SeChangeNotifyPrivilege
                  SeBackupPrivilege
                  SeRestorePrivilege
                  SeDebugPrivilege
0
Comment
Question by:mspolter
2 Comments
 
LVL 12

Accepted Solution

by:
zvitam earned 350 total points
ID: 12105343
look the the follwing URL you have a complete list of all security event IDs, look for event 528 to see when this user logged on, and event 538 to when he logged off.

http://www.privacywindows.com/securityfaq/security_systems.html
0
 

Author Comment

by:mspolter
ID: 12105911
There are 538's in the log for my name for yesterday (Sunday) and I was not here - no one should have my password - so how would there be successful log on and offs by themselves. My computer was left logged in over the weekend. Does kerberos renegotiate by itself if you are logged in and so to say relog in and out which would be logged, or did someone steal my username and password (which I would say is very unlikely)
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

Recently, a new law in my state forced us to get a top-to-bottom analysis of all of our contract client's networks. While we have documentation, it was spotty at best for some - and in any event it needed to be checked against reality. That was m…
In a recent article here at Experts Exchange (http://www.experts-exchange.com/articles/18880/PaperPort-14-in-Windows-10-A-First-Look.html), I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now