• State Verified Answer
  • Locked Locked
  • Replies 3 replies
  • Subscribers 25 subscribers
  • Views 6731 views
  • Users 0 members are here
Options
Related
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Last logon today from computerA

Herve.Morgado
over 6 years ago

Hello,

How would I go about generating a report that displays user's last logon + name of the computer where the last logon happened please?

Using Reporter 2.6 patch 3 and IT Security Search, I easily find the user's last logon but can I also find the computer name where the logon happened. I understand that this might also display servers but it might also help me pinpoint what user logs on to what workstation even though I have not run a full computer discovery but only an AD discovery.

Thanks for your help!

Herve

Parents
  • +1 over 6 years ago
    #1. Reporter: reports on AD users attributes value (state of the user)
    #2. CA or InTrust reports on user activities footprints (logs)
    you need #2 to report on client IP where users logged in + logonType (Interactive, Remote, Network ...)
    #3. ITSearch alloes to see all data from Reporter, CA/InTrust and provide analytics: Report for all AD\jsmith All Logons Interactive/Remote for last Xdays.

    Note, LastLogon and LastLogonTimeStamp - one is replicated and accurate 14 days, and another stored in DC logon cache and not replicated.
    Note, to report on Client (PC, laptop) logons you need install InTrust (or CA) Agent on all Clients (!) InTrust reporting on DC Security Log can provide indirect logon evidence (GPO access / load) with InTrust Agents on DCs only.
Reply
  • +1 over 6 years ago
    #1. Reporter: reports on AD users attributes value (state of the user)
    #2. CA or InTrust reports on user activities footprints (logs)
    you need #2 to report on client IP where users logged in + logonType (Interactive, Remote, Network ...)
    #3. ITSearch alloes to see all data from Reporter, CA/InTrust and provide analytics: Report for all AD\jsmith All Logons Interactive/Remote for last Xdays.

    Note, LastLogon and LastLogonTimeStamp - one is replicated and accurate 14 days, and another stored in DC logon cache and not replicated.
    Note, to report on Client (PC, laptop) logons you need install InTrust (or CA) Agent on all Clients (!) InTrust reporting on DC Security Log can provide indirect logon evidence (GPO access / load) with InTrust Agents on DCs only.
Children
No Data