View Logon Information

[Guest]

I use Hyena for just about all Network Admin tasks and on occasion have had cause to check the User logon information. I have noticed that there has sometimes been a logon and logoff for a particular user recorded at the same time (logon 18/07/01 12:15:45, logoff 18/07/01 12:15:45). When I attempt to verify this information in the PDC (or DC) event log there is no reference whatsoever. I am curious as to where Hyena is retreiving this information?

Thanks
Amraam

[cmccullough]

Re: View Logon Information

Hyena gets this information from the user record, which comes from the PDC.

In NT, the logon and logoff times are stored locally on the controller that validates a users authentication request, and does not synchronize that to the other controllers.

Hyena now has the ability to do a Check Controller to query all controllers for a specified user and see Last Logon times for that user, but not Last Logoff time.

It is not very clear in Microsoft documentation as to whether or not Last Logoff is accurately maintained and reported, and many programs similar to Hyena don't even show it at all.

Re: View Logon Information

This is a little follow-up question;
is it possible to generate a macro that gives information about all users logon times?

Because i want to check 1300 NT useraccounts for (in)activity...

Thanks in advance!

[cmccullough]

Re: View Logon Information

At this time you can only do this for one user at a time in Hyena.

You can use the freeware utility DumpSec at http://www.systemtools.com/somarsoft/ to do this. It has an option when dumping user information to Show Last 'True' Logon which will give you this information for your users.