0
Is there a way to tell who logged a user off with Windows 2012 Server? For example, I use rdp to log into a box that as multiple admins, there are some scripts that run under a specific user. The account was signed off this morning, and I need to determine who logged them off. There is the option for other admins to log off users via Task Manager -> Users Tab -> Right click -> Sign off.
Googling hasn't helped much on this. I ran Event Viewer and looked through the security subsection of Windows Logs. I'm looking through the details of the logoff category, but don't see a clear way of seeing who issued the log off... am I in the right location, or do I need to be looking somewhere else?
VenomFangs
Posted 2015-09-21T15:59:29.233
Reputation: 433
2Have you got the Logoff auditing policies enabled? – Ƭᴇcʜιᴇ007 – 2015-09-21T18:39:43.293
When you have identified which of the events states a logoff of a user you might want to use psloglist (https://technet.microsoft.com/en-us/sysinternals/bb897544.aspx) to export them (this even works on a remote server)
– Marged – 2015-09-22T22:12:30.550