Checking which user was logged into a machine at a specific time

[JoeJTaylor]

I have been asked to check which user was logged onto a specific machine (e.g. 172.1.1.2) on our network at a specific time (e.g. 3/11/09 - 12:54).
is there an easy way to do this from the server e.g some kind of security logs?

Thanks in advance for any help

The network is a mixture of XP Pro and Vista Business machines. The servers all run Windows Server 2003

 

[TechyMcSe2k]

check the Event Viewer under Security Settings. You can right click and do some filtering to thin out the information.

http://www.samtechconsulting.com

_______________________________________
Great knowledge can be obtained by mastering the Google algorithm.

 

[jet042]

http://technet.microsoft.com/en-us/library/cc787567(WS.10).aspx

There is the list of all the types of logon events that can be logged into the Security log. If you are looking for local access, you want 528 events, if you want network access they're 540 events.