Active Eirectory Experts - Queries

[*JimmyJ*]

Need to find out if a user logged on to the network after a particular time on a day. What would be the query I would run through active directory :S

 

[Longy]

Search the event viewer as long as you had the audit enabled for the logons/logoff?

Use Filters.

 

[*JimmyJ*]

on the workstation

 

[@Spoonie]

http://technet.microsoft.com/en-us/magazine/2006.01.scriptingguy.aspx

 

[Longy]

on the workstation

On the DC.

 

[DMS]

If you haven't altered the auditing settings via group policy (or via the local policy on the DC's or workstations), then both the workstation in question and the authenticating Global Catalog server should have audited the logon event.
It'll be logged in the event viewer under the Security item as a success audit. By default, failure audits aren't enabled for account logon events so you won't be able to see any failed logons.

 

[*JimmyJ*]

Cheers guys!

 

[Mike_182]

Aye, successful logon events for that user account. You'll have to check all DCs as well...