Solved

Quickly identify when user logs in/out - Windows 7

Posted on 2014-09-10
2
151 Views
Last Modified: 2014-09-12
I'm assuming it's in event viewer, but we need to track some users log on/off times. Is there a quick way to identify these without coming through all the security event logs each time I need to look at them. On a daily basis, for several employees, I need to be able to obtain log on/off for arrival, lunch hour, and departure.
0
Comment
Question by:HELFIT
2 Comments
 
LVL 34

Accepted Solution

by:
Dan Craciun earned 250 total points
ID: 40315471
Filter the log by events 4776 (Credential validation) and 4625 (Logon failed), source: Microsoft-Windows-Security-Auditing.

HTH,
Dan
0
 
LVL 9

Assisted Solution

by:dlb6597
dlb6597 earned 250 total points
ID: 40315810
are your users using domain logon accounts or local accounts?  4776 is logged on domain controllers when a domain account is used, or on local machines when a local account is used...

Windows 7 event viewer now has capabilities to associate a task with specific events...you can launch a script or send an email...the important part is figuring out where the relevant logs are happening and which events you care about...like 4800/4801 for workstation lock/unlock, 4624/4634 for account logon/account logoff.  Also be careful about making assumptions based solely on security events, it's easy to make assumptions.
0

Featured Post

Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

One of the features I've come to appreciate about Windows 7 and Windows Server 2008 R2 is the ability to pin applications to the task bar. As useful a feature as I've found this, it does have some quirks.  For example, have you ever tried pinning an…
While working, an annoying popup showing below will come and we cannot cancel or close it form the screen. The error message will come again and again.
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…
The viewer will learn how to successfully download and install the SARDU utility on Windows 7, without downloading adware.

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question