Pull cache of last logged on users?

PainlessTorture

Official Best Member
Vista Pro
Hey guys, In school I need to prove someone was logged onto a certain station. I know the login is cached but I have no idea how to extract it. Does anyone know how I can get the last few usernames of people who logged on?

Its in the registry somewhere isnt it?
Thanks
 

My Computer

System One

  • Name
    Fearghal
    Manufacturer/Model
    Hewlett Packard
    CPU
    3.40Ghz / 2.20Gz Duo Core
    Memory
    2GB / 3GB
    Hard Drives
    160 GB / 160 GB
    Occupation
    Student
    Country Flag
    uk

SCSIraidGURU

New Member
you can enabled auditing for successful logins and logoffs. Set event viewer not to overwrite logs. This will allow you to see the events.
 

My Computer

System One

  • CPU
    pair of Intel E5430 quad core 2.66 GHz Xeons
    Motherboard
    Supermicro X7DWA-N server board
    Memory
    16GB DDR667
    Graphics Card(s)
    eVGA 8800 GTS 640 MB video card
    Hard Drives
    SAS RAID

PainlessTorture

Official Best Member
Vista Pro
Except I need to see it now, its already been done. Is there a way to check who logged on which is enabled by default?
 

My Computer

System One

  • Name
    Fearghal
    Manufacturer/Model
    Hewlett Packard
    CPU
    3.40Ghz / 2.20Gz Duo Core
    Memory
    2GB / 3GB
    Hard Drives
    160 GB / 160 GB
    Occupation
    Student
    Country Flag
    uk

SCSIraidGURU

New Member
Did you enable logging in verbose mode in the policy? Did you check the event viewer security log. This is where it should be if enabled.
 

My Computer

System One

  • CPU
    pair of Intel E5430 quad core 2.66 GHz Xeons
    Motherboard
    Supermicro X7DWA-N server board
    Memory
    16GB DDR667
    Graphics Card(s)
    eVGA 8800 GTS 640 MB video card
    Hard Drives
    SAS RAID
Top