-1

I'm just wondering, is there a way to find out who was logged on a particular Windows server in the past year? Security log is only 1 month old or less and user profiles were deleted. Thanks a lot for any tips.

Martin_K
  • 1
  • 2
  • Is this a domain joined machine? Did the users log in on other machines since then? – Reaces Dec 10 '14 at 09:08
  • Hi, yes, it is domain joined. Users were also logged in other machines. – Martin_K Dec 10 '14 at 09:08
  • I was hoping that you could find some information on the users attributes in AD. But I can only see last logon timestamps, not where they were logged on... However perhaps you can dig further and find something there? – Reaces Dec 10 '14 at 09:14
  • That's what I wanted to do, but user profiles are deleted regularly from the server due to disk space. – Martin_K Dec 10 '14 at 09:25
  • Actually, I need to find out this information just to see if the servers are being used, and if not, they will be decommissioned. I think I will just power them off temporarily and see if someone will miss them :) Thanks anyway. – Martin_K Dec 10 '14 at 09:27

1 Answers1

-1

Is there a way to find out who was logged on a Windows server in a past year?

Yes, by checking the logs.

Security log is only 1 month old or less and user profiles were deleted.

Well, you're out of luck. You can find out who's logged in in the past month, though.

HopelessN00b
  • 53,795
  • 33
  • 135
  • 209
  • What about the LastLogon AD attribute the servers have? – Reaces Dec 10 '14 at 09:30
  • @Reaces There's no AD attribute that tracks which users log on to a particular computer. – HopelessN00b Dec 10 '14 at 09:32
  • I ment taking into account his comment about simply needing to know if a particular server is being used at all. (regardless of which users log in) – Reaces Dec 10 '14 at 09:34
  • @Reaces that comment thread's a trainwreck, frankly. Makes me want to close the question. If the security logs only go back a month, obviously it's being used ... and there's a log with a month's worth of logins to demonstrate its use. :/ – HopelessN00b Dec 10 '14 at 09:36
  • I know it can be done by checking logs, or timestamp on user profiles. I just wanted to know if there is any other way, but there probably isn't. Thanks anyway for your comments, I will have to work with what I have :) – Martin_K Dec 10 '14 at 09:47