..were you talking? :-p ________________________________ From: isalist-bounce@xxxxxxxxxxxxx on behalf of Thor (Hammer of God) Sent: Fri 2/9/2007 8:08 AM To: isalist@xxxxxxxxxxxxx Subject: [isalist] Re: OT: AD Sync to help investigations No fair! I replied before you but you posted first! Oh, I see. In bed with Tom, eh? Got the ole "post me first" checkbox selected eh?? :-p t On 2/9/07 6:12 AM, "Jim Harrison" <Jim@xxxxxxxxxxxx> spoketh to all: Define "disconnected"? Machine shutdown, Machine restart, last refresh of the secure channel, etc.? By default, the related DC security event logs contain machine as well as user logon/logoff events. From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On Behalf Of Gene Sibbs Sent: Friday, February 09, 2007 2:47 AM To: Active Directory; ISA Community Subject: [isalist] OT: AD Sync to help investigations Hi all How can I reveal through Active Directory when lastly the member of domain computer was disconnected from the domain. I need this information to help with investigations, surely they should be some log file I can drill down to. Thank you, ________________________________ Sucker-punch spam with award-winning protection. Try the free Yahoo! Mail Beta. All mail to and from this domain is GFI-scanned. All mail to and from this domain is GFI-scanned.