Re: Tracking down a user in a large AD network

"Robinson, Sonja" wrote:
> 
> Dump your event logs into  a text readable format (DumpEVT works well) and
> search for "Security,528" using Text Pad.  At the end of the transaction
> line will be the workstation number.  OR since you know the User ID.  Search
> on the USER ID and avoid extracting only logon info.  This way you can find
> out much more of what the user did.  It is easy to save your results into
> xls format for easy searching.
> 


This would involve looking at the logs of every machine in the network,
no?  I've keyed in on a few suspect machines to look for 528's with 
little success, but like I said, we have 100K users here, and I can't 
really afford, computationally, to extract all their logs.  =(