With Windows Server 2003, is there a way to determine: 1). The date a particular user account was created? 2). The last date/time a particular user logged into the SBS 2003 server? We have a virus problem that is creating bogus users with admin rights, which is why I need to know the above information. I'm just not sure how/where to find it. Thanks.John

Hello, Configure auditing and check logs in Security event viewer. More here: http://technet.microsoft.com/en-us/library/cc731607(WS.10).aspx More if you ask them here: http://social.technet.microsoft.com/Forums/en-US/category/sbsserver This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations Microsoft Certified IT Professional: Enterprise Administrator Microsoft Certified IT Professional: Server Administrator Microsoft Certified Trainer

You can use dsquery (on the DC) to retrieve the whenCreated attribute for any object. For example, for user with "pre-Windows 2000 logon" name "jsmith": dsquery * -filter "(sAMAccountName=jsmith)" -attr whenCreated If you have one DC, you can get last logon from net user: net user jsmith If you have more than one DC, you need to run this command on every DC and determine the latest date. Richard Mueller - MVP Directory Services