• State Verified Answer
  • Locked Locked
  • Replies 3 replies
  • Subscribers 25 subscribers
  • Views 6726 views
  • Users 0 members are here
Options
Related
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Last logon today from computerA

Herve.Morgado
over 6 years ago

Hello,

How would I go about generating a report that displays user's last logon + name of the computer where the last logon happened please?

Using Reporter 2.6 patch 3 and IT Security Search, I easily find the user's last logon but can I also find the computer name where the logon happened. I understand that this might also display servers but it might also help me pinpoint what user logs on to what workstation even though I have not run a full computer discovery but only an AD discovery.

Thanks for your help!

Herve

  • +1 over 6 years ago
    #1. Reporter: reports on AD users attributes value (state of the user)
    #2. CA or InTrust reports on user activities footprints (logs)
    you need #2 to report on client IP where users logged in + logonType (Interactive, Remote, Network ...)
    #3. ITSearch alloes to see all data from Reporter, CA/InTrust and provide analytics: Report for all AD\jsmith All Logons Interactive/Remote for last Xdays.

    Note, LastLogon and LastLogonTimeStamp - one is replicated and accurate 14 days, and another stored in DC logon cache and not replicated.
    Note, to report on Client (PC, laptop) logons you need install InTrust (or CA) Agent on all Clients (!) InTrust reporting on DC Security Log can provide indirect logon evidence (GPO access / load) with InTrust Agents on DCs only.
  • 0 over 6 years ago
    Thanks for your answer! We have CA for LDAP queries. Is it sufficient for user activities footprints please? Or we need another licence?
    Would access explorer provide Client logons if I target the PC please?
    Thanks!
  • +1 over 6 years ago
    CA for LDAP queries will not do User Logons Report.
    InTrust provides Logon Reports based on Security Event Log (DC, Servers, Clients/PC)
    CA Logons Module provides Logon Reports, good quick start, but might be limited comparing to InTrust.
    Both CA Logons Module and InTrust will require new license and whole new project. At this point I recommend to ask Quest/OneIdentity sales representative and engineer to get concrete emails on the matter.