if it's xp pro your talking about, its logged in event viewer under apps/winlogon