Detecting Interactive Logins for Service Account

[trigont@gmail.com]

Let me preface this by saying - I am a SQL Server DBA, so AD and dquery is way out of my league.

I am performing a clean up of some old service accounts use to start SQL. I have a few service accounts that were never marked for non-interactive logon. Can I query AD to see when was the last time (if any) someone logged on interactively? And if so, what ip address did that interactive logon come from?

PS - I have read about lastLogin and LastLoginTimestamp, and I have run some queries to get this info, but I still can't tell if it was an interactive login or a service starting up, nor can I tell the ip address the request came from.

If this doesn't work I'm gonna have to turn it off and see who screams. Which is not a solution I want to contemplate.

[Potawatomi]

SQL Server is a database engine running as services, that is to say, you just have to start the server for the application starts. The local service account is is a predefined account (BUILTIN), which exists in all versions of Windows from 2003 / XP (2003, XP, Vista and 2008). By this you get rights to choose single local user. Privileges available to it are local only, when attempting to connect to a remote machine is an application logon which made on it.