Is there a way for me to determine who connected to my server one week ago at a specific time (or within a time frame)? The server is running Windows Server 2003 R2. Is there a place I can go to view connection logs, mac addresses, ip addresses, etc. that may have connected to the server? The server and all possible candidates are within one domain. Any help is appreciated.

Have a look to this Microsoft article named "Enable Audit Events for Windows Firewall with Advanced Security". Check your firewalls log files. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

Hi, According to your post, the operating system is Windows Server 2003 R2. You may refer to the following article for how to enable Windows Firewall logging, Windows Firewall auditing and network tracing. Configuring a Computer for Windows Firewall Troubleshooting http://technet.microsoft.com/en-us/library/cc783179(WS.10).aspx Regards, Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.