Solved

Quickly identify when user logs in/out - Windows 7

Posted on 2014-09-10
2
152 Views
Last Modified: 2014-09-12
I'm assuming it's in event viewer, but we need to track some users log on/off times. Is there a quick way to identify these without coming through all the security event logs each time I need to look at them. On a daily basis, for several employees, I need to be able to obtain log on/off for arrival, lunch hour, and departure.
0
Comment
Question by:HELFIT
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 35

Accepted Solution

by:
Dan Craciun earned 250 total points
ID: 40315471
Filter the log by events 4776 (Credential validation) and 4625 (Logon failed), source: Microsoft-Windows-Security-Auditing.

HTH,
Dan
0
 
LVL 9

Assisted Solution

by:dlb6597
dlb6597 earned 250 total points
ID: 40315810
are your users using domain logon accounts or local accounts?  4776 is logged on domain controllers when a domain account is used, or on local machines when a local account is used...

Windows 7 event viewer now has capabilities to associate a task with specific events...you can launch a script or send an email...the important part is figuring out where the relevant logs are happening and which events you care about...like 4800/4801 for workstation lock/unlock, 4624/4634 for account logon/account logoff.  Also be careful about making assumptions based solely on security events, it's easy to make assumptions.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
There are many software programs on offer that will claim to magically speed up your computer. The best advice I can give you is to avoid them like the plague, because they will often cause far more problems than they solve. Try some of these "do it…
In this Micro Tutorial viewers will learn how to use Boot Corrector from Paragon Rescue Kit Free to identify and fix the boot problems of Windows 7/8/2012R2 etc. As an example is used Windows 2012R2 which lost its active partition flag (often happen…
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question