Finding when & which users login to Win2K

[fbrdphreak]

Hey all,
I need to know how you can find out which users logged into a Win2K Pro system and when they did it. We are running Novell if that makes a difference. Not sure if the event log is enabled by default on these systems. TIA

 

[EyeMWing]

Got domain? Or are these local logins?

 

[fbrdphreak]

These are all on the network if that is what you are asking. Specifically we're looking for a way to find out locally if they logged in. Timestamps or log files or something

 

[EyeMWing]

Originally posted by: fbrdphreak
These are all on the network if that is what you are asking. Specifically we're looking for a way to find out locally if they logged in. Timestamps or log files or something

... Are the userIDs in question domain users or local users?

Local users, I don't think you can find out. Domain users, check the logs on the domain controller.

 

[fbrdphreak]

Domain users, registered with the network & all. Was just hoping for a way to find out locally

 

[Rogue]

If auditing wasn't turned on for Logon/Logoff on the local machine it will be tough. Did login ONLY on the local machine? Do you have a network sniffer in the path that could catch the authentication data to/from the box? What do you suspect they did on the Win2k computer? Could any information be leaked from those files? Perhaps a website they visited, etc?

 

[Runes911]

Originally posted by: EyeMWing

Originally posted by: fbrdphreak
These are all on the network if that is what you are asking. Specifically we're looking for a way to find out locally if they logged in. Timestamps or log files or something

... Are the userIDs in question domain users or local users?

Local users, I don't think you can find out. Domain users, check the logs on the domain controller.

Hmm he said novell doubtful they have a DC.

 

[Jzero]

Originally posted by: fbrdphreak
Domain users, registered with the network & all. Was just hoping for a way to find out locally

If they are domain users, then their logon events should be recorded in the Security Event Log on the DC, along with what workstation originated the logon events.

 

[funkymatt]

c:\documents and settings\user

look at the timestamp on the username's folder... thats when they last logged in.

 

[acemcmac]

Originally posted by: funkymatt
c:\documents and settings\user

look at the timestamp on the username's folder... thats when they last logged in.

for the win :beer:

 

[fbrdphreak]

The DC is Novell Netware based, so they're thinking those logs were probably not setup. They know for sure they can check the last time a user logged in & from what IP, but we're not yet sure if the breach was someone logging in to an unauthorized machine w/their ID or the actual user's ID

 

[fbrdphreak]

Unfortunately the possible breach happened around 9/14-9/15 and the proper user has since logged into that system

 

[funkymatt]

oh, so someone obtained the username/password and logged in to the machine that normally uses that username? that complicates things a bit.

 

[fbrdphreak]

We're not sure. We will be checking the profiles (when a new user logins in through novell on a machine it creates that user's profile under "doc & settings") to see if someone unauthorized logged in with THEIR OWN acct, otherwise they probably breached the authorized user's acct. not sure which yet

 

[CVSiN]

this is why AD rocks... novell = yuck... we can tell to the second when any user logs into the domain from citrix/ipass/termserver or local workstation.

 

[sao123]

check the event log on the local machine

 

[fbrdphreak]

Thanks for the info guys, very helpful

 

[hevnsnt]

Right click on "My Computer" go to manage.

Click the plus next to event viewer
Select Secuity
See who logged in.

 

[fbrdphreak]

Problem with that is we think the images on these machines have event log disabled by default or something, but thx

 

[Jzero]

Originally posted by: fbrdphreak
Problem with that is we think the images on these machines have event log disabled by default or something, but thx

*forehead slap*

Use Group Policy to enable logging!!

 

[fbrdphreak]

Eh, I would agree but I'm just a lowly underling. They're going to XP Pro soon anyway *shrug*