Hi everybody,
We would like to know who is using the local admin account on their computer and how to obtain the last login information (timestamp in particular). Is there a way to get this info? We have implemented the Sherry Kissinger method (http://mnscug.org/blogs/sherry-kissinger/244-all-members-of-all-local-groups-configmgr-2012) but we are thinking that maybe our question is a bit simpler because we have the name of the local admin account, so we need to know when this account has been used for the last time.
One last question: can the information we'd like to know be retrieved even if the user has never logged in as local admin but it used the local admin account for the "run as administrator" function? In the end what we need to know is whether this account has been ever used or not (not necessary logged in).
Many thanks in advance