Karl
Fri May 19 09:23:36 CDT 2006
The best way is if Windows security auditing was previously configured. If
this was enabled, then you would see logins and logouts recorded in the
Windows Security Event log, by right-clicking My Computer, Manage.
http://securityadmin.info/faq.asp#auditing
If auditing was not enabled, you MIGHT be able to make an educated guess
about the last [and only the last] login by that user by looking at the
dates on the files in the user profile folder, such as the NTUser.dat.LOG
file in c:\documents and settings\username\. Definitely less accurate than
enabling auditing BEFORE the event you want to see.
However, it sounds to me like the security controls in use were flawed and
need correcting. Unattended Windows sessions should lock themselves at the
screen saver after 10 minutes, and users that log in should not be able to
read other users' email.
"Kevin Norris" <Kevin Norris@discussions.microsoft.com> wrote in message
news:5DE8F2A5-3046-4EA4-8ABC-6B9055CF271C@microsoft.com...
> I have a computer in our office that was already logged in when the user
came
> in. I am trying to find out when the computer was logged ini to see if
> someone was using it at night to read the person's email. Does anyone know
> where I can find a log of when it was logged in last?