https://community.splunk.com/t5/Getting-Data-In/Active-Directory-User-Audit/m-p/40064#M7448 <P>Need a search to report the last time a user has logged into Windows Active Directory. Assumption is this would be done by searching the WMI:WinEventLog:Security events. Would like it to report the date/time they last logged on, account name, workstation/host name, etc...</P> Fri, 23 Dec 2011 15:34:10 GMT gharpe2 2011-12-23T15:34:10Z https://community.splunk.com/t5/Getting-Data-In/Active-Directory-User-Audit/m-p/40064#M7448 <P>Need a search to report the last time a user has logged into Windows Active Directory. Assumption is this would be done by searching the WMI:WinEventLog:Security events. Would like it to report the date/time they last logged on, account name, workstation/host name, etc...</P> Fri, 23 Dec 2011 15:34:10 GMT https://community.splunk.com/t5/Getting-Data-In/Active-Directory-User-Audit/m-p/40064#M7448 gharpe2 2011-12-23T15:34:10Z https://community.splunk.com/t5/Getting-Data-In/Active-Directory-User-Audit/m-p/40065#M7449 <P>Hi Gharpe,</P> <P>The Last Logon Reporting tool from ManageEngine ADManager Plus will help you achieve this- The tool is completely free and comes bundled along with other useful Free Active Directory tools. The tool can be downloaded from : <A href="http://www.manageengine.com/products/free-windows-active-directory-tools/free-active-directory-tools-index.html">http://www.manageengine.com/products/free-windows-active-directory-tools/free-active-directory-tools-index.html</A></P> <P>For more detailed audit reporting you might also checkout ManageEngine ADAudit Plus - Active Directory change audit and reporting solution. <A href="http://www.adauditplus.com">http://www.adauditplus.com</A>.</P> <P>Hope this helps. </P> Mon, 26 Dec 2011 09:43:34 GMT https://community.splunk.com/t5/Getting-Data-In/Active-Directory-User-Audit/m-p/40065#M7449 dashokkumar 2011-12-26T09:43:34Z