• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 158
  • Last Modified:

Quickly identify when user logs in/out - Windows 7

I'm assuming it's in event viewer, but we need to track some users log on/off times. Is there a quick way to identify these without coming through all the security event logs each time I need to look at them. On a daily basis, for several employees, I need to be able to obtain log on/off for arrival, lunch hour, and departure.
0
HELFIT
Asked:
HELFIT
2 Solutions
 
Dan CraciunIT ConsultantCommented:
Filter the log by events 4776 (Credential validation) and 4625 (Logon failed), source: Microsoft-Windows-Security-Auditing.

HTH,
Dan
0
 
dlb6597Commented:
are your users using domain logon accounts or local accounts?  4776 is logged on domain controllers when a domain account is used, or on local machines when a local account is used...

Windows 7 event viewer now has capabilities to associate a task with specific events...you can launch a script or send an email...the important part is figuring out where the relevant logs are happening and which events you care about...like 4800/4801 for workstation lock/unlock, 4624/4634 for account logon/account logoff.  Also be careful about making assumptions based solely on security events, it's easy to make assumptions.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now