Configure the Audit Policy in the Default Domain GPO to audit success/failure of Account Logon Events and Logon Events. You can use a free utility such as EventCombMT ( http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=9989D151-5C55-4BD3-A9D2-B95A15C73E92) to collect the audit data from several machines into a single location for easy viewing and analysis.
Dig Deeper on Enterprise infrastructure management
Related Q&A from Laura Hunter
Active Directory expert Laura E. Hunter explains to a reader what must be done to change the default display specifiers for new users in Active ... Continue Reading
Our server management expert explains how to perform an inter-site replication between two domain controllers. Continue Reading
Our server management expert reveals two ways that admins can disable the Open File Security Warning dialog box. Continue Reading