Hello all. I've searched google and the forum and was unable to find anything on this topic.
I have a user with a roaming profile enabled and I have the user's ntuser.dat file from the server. I'm well versed in roaming profiles and know they don't always roam correctly (sometimes do not get written back to the server or downloaded from consistently). Assuming everything is working correctly, is there anything in the user's profile that can tell me what machines the user has logged in to? I'd even take only the location the user last logged in to.
I know I can look event logs, but auditing wasn't configured for long enough. The network is busy and the audit trails rolled over before I got to them. We aren't backing them up (
No auditing is configured on the client machines and we have a huge number of those out there anyway. My last resort is to hit each of our 500+ client machines and see which machines have a copy of the profile in the "documents and settings" folder.
It seems like the login locations should be in the user's profile somewhere. Anyone have any idea how to extract this information? Thanks.