Celebrate National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Quickly identify when user logs in/out - Windows 7

Posted on 2014-09-10
2
Medium Priority
?
156 Views
Last Modified: 2014-09-12
I'm assuming it's in event viewer, but we need to track some users log on/off times. Is there a quick way to identify these without coming through all the security event logs each time I need to look at them. On a daily basis, for several employees, I need to be able to obtain log on/off for arrival, lunch hour, and departure.
0
Comment
Question by:HELFIT
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 35

Accepted Solution

by:
Dan Craciun earned 1000 total points
ID: 40315471
Filter the log by events 4776 (Credential validation) and 4625 (Logon failed), source: Microsoft-Windows-Security-Auditing.

HTH,
Dan
0
 
LVL 9

Assisted Solution

by:dlb6597
dlb6597 earned 1000 total points
ID: 40315810
are your users using domain logon accounts or local accounts?  4776 is logged on domain controllers when a domain account is used, or on local machines when a local account is used...

Windows 7 event viewer now has capabilities to associate a task with specific events...you can launch a script or send an email...the important part is figuring out where the relevant logs are happening and which events you care about...like 4800/4801 for workstation lock/unlock, 4624/4634 for account logon/account logoff.  Also be careful about making assumptions based solely on security events, it's easy to make assumptions.
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Did you know SD-WANs can improve network connectivity? Check out this webinar to learn how an SD-WAN simplified, one-click tool can help you migrate and manage data in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

First some basics on Windows 7 Backup.  It has 2 components one is a file based backup which is stored in .zip files each zip is split at around 200 Megabytes and there is the Image Backup which is as the name implies a total image of the partition …
If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
This Micro Tutorial will go in depth within Systems and Security in Windows 7 and will go into detail regarding Action Center, Windows Firewall, System, etc. This will be demonstrated using Windows 7 operating system.
Suggested Courses

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question