Objective  

This article explains how to access the Users First and Last Logon By Computers report in ADAudit Plus. This report helps administrators track the initial and most recent logon times of users on specific computers within the domain.

Prerequisites  

• You must have access to the ADAudit Plus web console with an administrator account or a technician account with permissions to view reports.

• Your on-premises domain controllers (DCs) must be configured in ADAudit Plus, and event data must be collecting successfully.

• The necessary audit policies, specifically Audit Logon Events, must be enabled on your DCs to ensure logon data is generated and collected.

Steps to follow  

1. Log in to the ADAudit Plus web console.
   
2. Navigate to the Reports tab.

3. From the left pane, expand the User Logon Reports category.

4. Click the Users First and Last Logon By Computers report.
   
   
   

Validation and confirmation  

• The report will generate and display the logon data.
  
• Verify that the report includes columns such as User Name, Computer Name, First Logon Time, and Last Logon Time.

• You can use the filter and search options at the top of the report to find logon information for specific users or computers.
  

Tips  

• This report is useful for security investigations to determine the first time a user accessed a critical server or to track the last known location of a user's activity.

• Use the Export as option to save the report data in formats like PDF or CSV for compliance documentation.

Related topics and articles  

• Real-Time User Logon Audit Reports