Is it possible to track who was logged onto a PC at certain dates and times?

I have a user who was recently fired and I found some interesting Web pages on her computer. I want to know how to track who was logged on to her computer on certain dates and times. Is this possible?
First, make sure that you're legally entitled to search this computer. Check with your legal and HR departments to ensure the employee had acknowledged your acceptable computer use policy, and that the employee was specifically told that their behavior was being monitored. You can tell who was logged into the computer if:
  1. You have user-specific accounts created (everyone doesn?t log on as ?Administrator?).
  2. You have successful logon auditing enabled on the client computer.
  3. The security logs are still available?depending on the configuration, these may be deleted after a certain period of time or number of events.

If you meet all of these requirements, just look in the Security Event Log of the computer. You?ll find the Event Viewer located in the Administrative Tools folder.

This was first published in August 2002

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.
    Back to top