Find out when a user gained access to a server or when they last logged in to it

I need to find out when a user was granted access to a specific server. I would also like to know if they were knocked off at some point and granted access again recently.

If this is not possible is it at least possible to find out when they last logged in?
KingMooBotAsked:
Who is Participating?
 
shestersCommented:
If your server is auditing logon events then you should be able to go to the event viewer - security log and see when the user last logged on. However, depending on the number of users this could take some weeding through logs.

 You might be able to look at your dhcp logs and see when the user obtained their IP address lease (only if the server in question is the dhcp server).

0
 
KingMooBotAuthor Commented:
I see. Do you know if events are backed up? I can go back to Feb.21, a week short of where I need to chec...
0
 
ChiefITCommented:
You can see additional information in AD, including last logged on date and time:

http://www.petri.co.il/view_additional_user_information_in_aduc.htm

This works best for a single user to a couple users..

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.