There is no good way to tell. AD does keep track. You can use logon and logoff scripts to write information to a shared file and use this to tell which user last logged into (and perhaps is still logged into) a given computer. I have example logon and logoff (also startup and shutdown) scripts that log information linked on this page:
http://www.rlmueller.net/Logon5.htmAnother option is to query a server for sessions, but this is not reliable (sessions come and go depending on user activity on the server), and is only practical if there are just a few servers. For example:
Option Explicit
Dim objDC, objSession
Set objDC = GetObject("WinNT://MyServer/LanmanServer")
For Each objSession In objDC.Sessions
Wscript.Echo objSession.Name
Wscript.Echo objSession.User
Wscript.Echo objSession.Computer
Next
The computer is often identified by IP address. A final option is to enable auditing, but the resulting logs are large and difficult to parse.
Richard Mueller
MVP ADSI
