Get logon logs from your DCs, identify the workstations where accounts logs on
Extract a .csv with account / workstation / date in the working directory.
Running
CSV extracted
- Active directory powershell module (installed with AD RSAT)
- Success logon audit activated on your DCs, see :
https://support.microsoft.com/en-us/help/556015, Option 1, part 1.
(You can increase the 'security' eventlog size on your DCs, to get more events)
- Fill-up the $accounts list with the domain accounts you want to search for
- Run the script