Sign in
Microsoft.com
 
System Center Essentials TechCenter
 
 
 
System Center Essentials TechCenter > System Center Essentials Forums > System Center Essentials - General > Find out what time computer was last found on the domain
Ask a questionAsk a question
Search Forums:
 

AnswerFind out what time computer was last found on the domain

  • Tuesday, June 02, 2009 3:01 PMca.xl1200n Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
    We recently had a laptop stolen from our office over the weekend.  I am trying to determine approximately what time the laptop was stolen.  It was on the network and powered on so there should be some active directory information for the machine.  I just don't know how to go about retrieving the info.  Any help is most appreciated.

    Thanks,
    ca
     

Answers

All Replies

  • Wednesday, June 03, 2009 7:42 PMLee Chang [MSFT]MSFT, ModeratorUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Answer
    Sign In to Vote
    0
    Sign In to Vote
    Hi ca, Was the laptop being managed by SCE? If so, you may be able to look at it in the Monitoring->Computers view, and see what time the last state change event was.
     
  • Monday, June 29, 2009 11:15 AMEric Zhang - MSFTMSFT, ModeratorUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
    Hi ca,

    For more information about quering last logon time ,we can get the time in AD database.

    There is an attribute named lastLogon for each computer account. However, it is in a binary format and you need to convert it to a friendly Date/Time format. There are some scripts.

    Convert binary data to decimal

    http://social.msdn.microsoft.com/forums/en-US/transactsql/thread/d34685b9-deba-464f-a977-df24f53bdcf6/