Win2003: Does it log what computer a user logs in from?

[Kenazo]

Here's the email from one of our users:

Yesterday, just after 5:00, I was kicked off the server because it said someone else logged in under my name. My desktop items were also all messed up after that as well. Did someone log in under my name yesterday?

Thus my question, is there a log of where her user all logged in from yesterday? 🙂

Thanks.

 

[LOFBenson]

If you are auditing logon/logoff success attempts then the security event log will show the originating IP address

 

[Kenazo]

I'm a win2003 noob. How do I do that. 🙂

 

[LOFBenson]

if you arn't in a domain. open up the local security policy on the terminal server. local policies. audit policy. if you are in a domain then you can add it to the correct group policy the same way.

 

[barnett25]

However this will only start auditing from this point on, it will not tell you what happened before.