Ressourcen für IT-Professionals >
Forenhomepage
>
System Center Essentials - General
>
Find out what time computer was last found on the domain
Find out what time computer was last found on the domain
- We recently had a laptop stolen from our office over the weekend. I am trying to determine approximately what time the laptop was stolen. It was on the network and powered on so there should be some active directory information for the machine. I just don't know how to go about retrieving the info. Any help is most appreciated.
Thanks,
ca
Antworten
- Hi ca, Was the laptop being managed by SCE? If so, you may be able to look at it in the Monitoring->Computers view, and see what time the last state change event was.
- Als Antwort markiertEric Zhang - MSFTMSFT, ModeratorMontag, 8. Juni 2009 10:47
Alle Antworten
- Hi ca, Was the laptop being managed by SCE? If so, you may be able to look at it in the Monitoring->Computers view, and see what time the last state change event was.
- Als Antwort markiertEric Zhang - MSFTMSFT, ModeratorMontag, 8. Juni 2009 10:47
- Hi ca,
For more information about quering last logon time ,we can get the time in AD database.
There is an attribute named lastLogon for each computer account. However, it is in a binary format and you need to convert it to a friendly Date/Time format. There are some scripts.
Convert binary data to decimal
http://social.msdn.microsoft.com/forums/en-US/transactsql/thread/d34685b9-deba-464f-a977-df24f53bdcf6/
