When did the laptop last talk to the Domain Controller?

Is there way you can tell on a Win2k8 Domain Control when a Win 7 client PC last spoke to the DC?  Would that be logged?  Thank you.
LVL 2
amigan_99Network EngineerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

comfortjeaniusCommented:
You can use the dsquery command

windows key + r

type: cmd and hit enter

In the cmd windows type:  dsquery computer -inactive <N>

N is the number of weeks

this will show you stale computer accounts

or if you looking for  a particular computer
 type: dsquery computer -name j*

If you know how many weeks you also can type:
disquery computer -name j* -inactive 8

This command will list all computer beginning with the letter j and 8 weeks of inactivity.

Here is a link Dsquery Computer
0
amigan_99Network EngineerAuthor Commented:
That looks in the right neighborhood.  But a couple of things.  I want to see within say an hour window - when was the last time a computer touched the network.  Is there anything that is the equivilant of "Computer JumboFries last checked into the network 8pm Saturday 9/28/13" ??
0
comfortjeaniusCommented:
I haven't test yet but you should be able to perform these actions from powershell

Get last login time

LastLogonTimestamp
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

amigan_99Network EngineerAuthor Commented:
What I found that helped me narrow this down was DHCP lease logging.  I could see the last time it successfully renewed (around 7am) and the when it lost its least (about 7pm).  As the least timer was 8 hours I can reasonably say that the host was on the nextwork after 7am but not longer than 11am.  Narrowing it down!  

I think login times would be the times when a user actually logged in.  But this is over the weekend when a user wouldn't have been logging in or out.
0
vivigattCommented:
Logging log-in time would not take into considerations computers that wake up from sleeping or hibernation state.
DHCP is not very reliable either, unless you set a short lease time. Let's say a 2 hours lease time. Then, since the dhcp clients ask to renew their lease when it half expired, you would get your 1hour granularity. But if a user sets a computer to use a static IP address, you would not get any dhcp log...
You could monitor ARP cache of some server or ARP messages, using a short ARP cache timeout (DHCP option 35), but this is not very reliable either.
What would be the most reliable, in my opinion, would be to use a packet capture or monitoring tool and check what is the traffic associated to your hosts.
However, all depends on your actual aims (accounting, security, monitoring...)
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
amigan_99Network EngineerAuthor Commented:
Well the aim in this case was to find out when multiple laptops were stolen.  
Based on all the information - DHCP lease plus AV check-in timers were my best best indicators.  I was able to narrow things down to a 90 minute window.  I factored in the issues like static IPs (none of these non-technical users have them) and computers possibly going into standby or what-have-you.  Thank you for the thoughts.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 7

From novice to tech pro — start learning today.