Quickly identify when user logs in/out - Windows 7

I'm assuming it's in event viewer, but we need to track some users log on/off times. Is there a quick way to identify these without coming through all the security event logs each time I need to look at them. On a daily basis, for several employees, I need to be able to obtain log on/off for arrival, lunch hour, and departure.
HELFITAsked:
Who is Participating?
 
Dan CraciunConnect With a Mentor IT ConsultantCommented:
Filter the log by events 4776 (Credential validation) and 4625 (Logon failed), source: Microsoft-Windows-Security-Auditing.

HTH,
Dan
0
 
dlb6597Connect With a Mentor Commented:
are your users using domain logon accounts or local accounts?  4776 is logged on domain controllers when a domain account is used, or on local machines when a local account is used...

Windows 7 event viewer now has capabilities to associate a task with specific events...you can launch a script or send an email...the important part is figuring out where the relevant logs are happening and which events you care about...like 4800/4801 for workstation lock/unlock, 4624/4634 for account logon/account logoff.  Also be careful about making assumptions based solely on security events, it's easy to make assumptions.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.