you can read the local machine security log for:
event: 538
where User is not ANONYMOUS LOGON or SYSTEM
_________________________
How to ask questions the smart way <-----------> Before you ask