Q. Does Active Directory keep a log of all machines a user logs onto?

Q. Does Active Directory keep a log of all machines a user logs onto?

A. No. Active Directory logs the last log-on time for a user, but it does not keep a log of all machines a user has logged onto.

If you need this information, it is stored in the Security log of each machine. You would need to harvest these logs from each machine in the domain, store them in a database and then run reports against that database.

One option would be to leverage System Center Operations Manager Audit Collection Services (ACS) to gather the security logs and then write a custom report against the ADS database as there is no built-in report that would give the exact information needed. The key event to look for would be 4624, a successful log-on.