who logged in to windows 2000

I have a windows 2000, and it is protected with a password for every user.
how can I know who logged in and when he logged in.

I scanned thru other computer to that windows 2000 thru GFI LANguard N.S.S and it showed me:

The PasswordAge
Logons
Bad Passwords Counts
LastLogon

where in windows 2000 I can see that info?
because someone broke into our server and changed one of the users password, and I would like to know the details and from which IP he did it.

Thanks in Advance,

Miro
LVL 1
miro23Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Mike KlineCommented:
Miro,

Hello take a look at this article about Windows logon and logoff activity

https://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/monitor/logonoff.mspx
Tracking Logon and Logoff Activity in Windows 2000

If you have logging turned on then you will look in the Windows event logs.   Specifically you will look in the security events.  Since this attack was successful you are going to look for event 528 or 540.

When you say he broke in and changed a password is this a domain account that he changed (active directory); or is this a local account on a machine.

Please let me know if that helps.

Thanks
Mike
 
 

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
sirbountyCommented:
I use pstools: http://www.sysinternals.com/Utilities/PsLoggedOn.html
Psloggedon \\servername
Sam PanwarSr. Server AdministratorCommented:
Hi,

Download
Abtutor control
Server side install and client side installl
read all document carefully
then connect you see all the information with graphicallly of logged user

software

http://www.download.com/AB-Tutor-Control/3000-7240_4-10267819.html
miro23Author Commented:
thanks alot about the comments, it helped me alot
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 2000

From novice to tech pro — start learning today.