• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 308
  • Last Modified:

How to know what is the last time a local user has been used in Win 2000 server?

How to know what is the last time a local user has been used in Win 2000 server?
0
SAM2009
Asked:
SAM2009
  • 2
  • 2
2 Solutions
 
oBdACommented:
Check the date and time of "ntuser.dat" in the root of the user's profile folder (C:\Documents and Settings\<LocalUserName>).
If in doubt, restart the server before checking, in case there's a local service account.
0
 
SAM2009Author Commented:
All right thanks.

But if a user uses local account to authenticate on FTP service for exemple or another application on server is there a way to see the trace?
0
 
oBdACommented:
You'd only see this in the security protocol as event ids 528 and 540, probably logon type 3; whether you can find out when it was last used depends on whether your event log dates back far enough ...
Logon Type Codes Revealed
http://www.windowsecurity.com/articles/Logon-Types.html
0
 
SAM2009Author Commented:
Thank you
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now