Logon history - Is there a way to see who logged in to a Win2003 network over the weekend?

I have been asked to find out who has logged into the network over the weekend. Is there a way to do this? Would some specific type of logging have to be enabled to do so? I am setting up a login script to create logs for all network logins, but this won't help for the past weekend.

Thanks.
BHForumAsked:
Who is Participating?
 
TasmantCommented:
You can review the security event logs of your DCs.
By default the audit is activated for all successfull logons on domain controllers.
If you want to monitor failure, you need to modify the default domain controller policy.
0
 
abbrightCommented:
If you go to the event-viewer, security you see all security-related events the server logged. If you filter for "Event source: Security", "Category: Logon/Logoff" and Event ID: 528 or 540 you should see all logons. Logontype 10 are remote interactive logons. More details can be found here: http://www.windowsecurity.com/articles/Logon-Types.html
0
 
Marcus MartinSystem Support OfficerCommented:
Have a look in your event logs under Security

You will have to check each Domain Controller though as I'm guessing you wont know which DC the user logged on to. Security Logging i think is on by default if its not then your out of luck. But see below for the best practice guide. Hope this helps

http://technet.microsoft.com/en-us/library/cc778162(WS.10).aspx
0
 
BHForumAuthor Commented:
Got it guys. Looks like the events were configured to NOT log any login/logoff activity. I will be pouring over these settings today.

Thanks,
0
 
BHForumAuthor Commented:
I was wondering why I didn't see them there.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.