How to find out user logons dates into windows?


  1. Posts : 16
    windows 11
       #1

    How to find out user logons dates into windows?


    Online tutorials say to just look at the 4624 event IDs in the security log, but I have it spammed every 1-5 minutes in there by "system", it's not helpful.
      My Computer


  2. Posts : 14,020
    Win10 Pro and Home, Win11 Pro and Home, Win7, Linux Mint
       #2

    I've also a large number in Event Viewer, Windows logs, Security. Keep in mind that the list works just like File Explorer, the columns in the panes can be sorted by clicking the heading of the column to re-sort, makes it easier to get to a specific item.
      My Computers


  3. Posts : 16,950
    Windows 10 Home x64 Version 22H2 Build 19045.4170
       #3

    gendalf said:
    Online tutorials say to just look at the 4624 event IDs in the security log, but I have it spammed every 1-5 minutes in there by "system", it's not helpful.
    I do not use that event but others to see the record of user logins, logoffs.
    Mine only records user logins, logoffs I see no any spurious entries, System or otherwise,

    Here's a zipped Event viewer Custom view definition
    User log on-off.zip
    - Unzip it to extract its view definition file [which has an xml extension]
    - Open Event viewer
    - On the right-hand side, click on Import Custom view...
    - Browse to and select the view definition file [xml] you've just unzipped, click on the Open button
    - If you want to you can rename it in the view definition Properties dialog that now appears
    - Click on OK

    You will be able to see its recorded events by clicking, on the left-hand side of the Event viewer window, Custom views and then selecting the User log on-off entry in the list of Custom views.

    My Custom view definition uses the events in the Microsoft-Windows-User Profile Service/Operational log. I could tie the view definition down even further by only recording events 1,4 but I've never bothered.
    - The definition shows 5 entries at every login & 2 at every logoff.
    - If I did tie it down further I think I might end up going to that log to see what else was recorded if there was ever a problem. That's why I decided to leave it as open as it is.

    If you did want to tie it down further, you could
    - right-click on the User log on-off entry, select Properties
    - click on Edit filter...
    - In the Event sources input box, type in [just for example] 1,4 [without any spaces between them]
    - OK
    -
    Close then restart Event viewer


    All the best,
    Denis
    Last edited by Try3; 21 Jan 2022 at 10:57.
      My Computer

  4.   My Computer


  5. Posts : 16
    windows 11
    Thread Starter
       #5

    I think what I needed might've been 4801, but nirsoft also works, it has so much stuff that even having that tool doesn't mean I know I already have a solution
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 06:16.
Find Us




Windows 10 Forums