How to check user login history in Active Directory

The Active Directory (AD) user login history is a record of a user's successful and failed logins, reconstructed from security log events across domain controllers (DCs) and endpoints. Auditing the AD user login history is essential for meeting the security and compliance needs of any IT environment. It enables administrators to:

• Detect unusual or potentially malicious behavior, such as a surge in failed login attempts.
• Maintain a comprehensive audit trail of all logins across the domain.

To check a user’s login history:

1. Enable login auditing via a Group Policy.
2. Obtain information from the relevant event IDs in the security log using Event Viewer, PowerShell, or a login history auditing tool like ADAudit Plus.

1. Enable login auditing via a Group Policy

2. Analyze the user login history using Event Viewer

3. Get the user login history using PowerShell

• Open PowerShell as an administrator (as required for security log access).
• Enter the PowerShell script below.

Update the script parameters based on your requirements

• Time range: Modify the AddDays value in the StartTime to match the required period (for example, -2 for the last two days).
• DCs: By default, the script discovers all DCs automatically.

PowerShell script

$DCs = (Get-ADDomainController -Filter *).HostName

foreach ($dc in $DCs) {
    $events = Get-WinEvent -ComputerName $dc -FilterHashtable @{
        LogName   = 'Security'
        ID        = 4768, 4771
        StartTime = (Get-Date).AddDays(-2)   # Last 2 days
    } -ErrorAction SilentlyContinue

    foreach ($event in $events) {
        $xml    = [xml]$event.ToXml()
        $user   = ($xml.Event.EventData.Data | Where-Object { $_.Name -eq 'TargetUserName' }).'#text'
        $ip     = ($xml.Event.EventData.Data | Where-Object { $_.Name -eq 'IpAddress' }).'#text'
        $status = ($xml.Event.EventData.Data | Where-Object { $_.Name -eq 'Status' }).'#text'

        # 4771 is always a failure; 4768 is a success only when Status = 0x0.
        $result = if ($event.Id -eq 4768 -and $status -eq '0x0') { 'Success' } else { 'Failed' }

        [PSCustomObject]@{
            User   = $user
            Result = $result
            IP     = $ip
            Time   = $event.TimeCreated
            DC     = $dc
        }
    }
}
        

4. Get the user login history using ADAudit Plus

1. Log in to ADAudit Plus as an administrator.
2. Navigate to Active Directory > Auditing > User Logon Reports > User Logon Activity.
3. Select the Domain, Period, and Objects for which you want to view the user login history.

Bridging the gaps in native auditing with ADAudit Plus

Limitations in native Windows auditing tools, such as the need for expertise, the time-intensive process, and the missing capabilities listed below, make it necessary to use third-party auditing tools like ADAudit Plus.

• Centralized auditing: Event logs that contain login audit data are not replicated, so manually reviewing logs on each computer is impractical. While Windows Event Forwarding enables log aggregation, setting it up involves technical complexity. ADAudit Plus simplifies the process by aggregating logs from all computers in a central console.
• Threat mitigation: Windows Task Scheduler can send alerts on specific event IDs but cannot detect unusual patterns, like multiple failed logins followed by a successful one: a telltale sign of a brute-force attack. ADAudit Plus leverages correlation and machine learning to detect such patterns in real time.
• Compliance reporting: Windows events often lack complete context. For example, a user's login duration is split across events, requiring manual correlation. PowerShell can help but isn’t practical for real-time auditing at scale. ADAudit Plus provides a consolidated audit trail of all changes and helps you meet compliance requirements.

FAQ and Troubleshooting