We recently had a laptop stolen from our office over the weekend.  I am trying to determine approximately what time the laptop was stolen.  It was on the network and powered on so there should be some active directory information for the machine.  I just don't know how to go about retrieving the info.  Any help is most appreciated.<br/> <br/> Thanks,<br/> ca© 2009 Microsoft Corporation. All rights reserved.Mon, 29 Jun 2009 11:15:08 Z00652c6e-28e4-44d7-a7d3-45e245b66c95http://social.technet.microsoft.com/Forums/en-US/systemcenter/thread/00652c6e-28e4-44d7-a7d3-45e245b66c95#00652c6e-28e4-44d7-a7d3-45e245b66c95http://social.technet.microsoft.com/Forums/en-US/systemcenter/thread/00652c6e-28e4-44d7-a7d3-45e245b66c95#00652c6e-28e4-44d7-a7d3-45e245b66c95ca.xl1200nhttp://social.technet.microsoft.com/Profile/en-US/?user=ca.xl1200nWe recently had a laptop stolen from our office over the weekend.  I am trying to determine approximately what time the laptop was stolen.  It was on the network and powered on so there should be some active directory information for the machine.  I just don't know how to go about retrieving the info.  Any help is most appreciated.<br/> <br/> Thanks,<br/> caTue, 02 Jun 2009 15:01:06 Z2009-06-02T15:01:06Zhttp://social.technet.microsoft.com/Forums/en-US/systemcenter/thread/00652c6e-28e4-44d7-a7d3-45e245b66c95#39420069-8911-4be3-8f6e-2643f9bfc371http://social.technet.microsoft.com/Forums/en-US/systemcenter/thread/00652c6e-28e4-44d7-a7d3-45e245b66c95#39420069-8911-4be3-8f6e-2643f9bfc371Lee Chang [MSFT]http://social.technet.microsoft.com/Profile/en-US/?user=Lee%20Chang%20%5bMSFT%5dHi ca, Was the laptop being managed by SCE? If so, you may be able to look at it in the Monitoring-&gt;Computers view, and see what time the last state change event was.Wed, 03 Jun 2009 19:42:38 Z2009-06-03T19:42:38Zhttp://social.technet.microsoft.com/Forums/en-US/systemcenter/thread/00652c6e-28e4-44d7-a7d3-45e245b66c95#7d788f12-2d61-4a50-a409-cd84dd779360http://social.technet.microsoft.com/Forums/en-US/systemcenter/thread/00652c6e-28e4-44d7-a7d3-45e245b66c95#7d788f12-2d61-4a50-a409-cd84dd779360Eric Zhang - MSFThttp://social.technet.microsoft.com/Profile/en-US/?user=Eric%20Zhang%20-%20MSFTHi ca,<br/> <br/> For more information about quering last logon time ,we can get the time in AD database.<br/> <br/> There is an attribute named lastLogon for each computer account. However, it is in a binary format and you need to convert it to a friendly Date/Time format. There are some scripts.<br/> <br/> Convert binary data to decimal<br/> <br/> http://social.msdn.microsoft.com/forums/en-US/transactsql/thread/d34685b9-deba-464f-a977-df24f53bdcf6/<br/> <br/>Mon, 29 Jun 2009 11:15:08 Z2009-06-29T11:15:08Z