Sign in with
Sign up | Sign in
Your question

Using Event Viewer to establish whether a PC was in use

Last response: in Windows 7
Share
July 26, 2012 12:00:00 PM

Hi,

I haven't used Event Viewer before and I'm not sure how to interpret events. All I want is to establish whether a PC was a) on and b) in use between 00:00 and 03:30 on a particular day. What is the easiest way to go about that?

Thanks!

More about : event viewer establish

a c 228 $ Windows 7
July 26, 2012 12:49:14 PM

Well, (a) the event viewer can't do anything if the pc is off, so any events must occur when the computer is on. (b) You can create a filter for login and logut events to see when someone has logged in and out, but you won't be able to tell what they are doing. better yet is to turn on audit logging.

http://superuser.com/questions/337371/how-can-i-use-eve...
July 26, 2012 1:27:54 PM

Thanks Hawkeye. Before I get my head around audit login. If I set it up now will I be able to use it to check historic data. If I can, will this show me whether somebody has been using a browser or other applications etc?
Related resources
a b $ Windows 7
July 26, 2012 1:33:56 PM

MathMcC said:
Thanks Hawkeye. Before I get my head around audit login. If I set it up now will I be able to use it to check historic data. If I can, will this show me whether somebody has been using a browser or other applications etc?

Turning on the audit log tells the machine to START recording that kind of data. If the data isn't being recorded, then you can't check any history, because none was recorded.
July 26, 2012 1:41:23 PM

Apologies, I think I'd misunderstood audit login, it looks like this actually reduces the amount of events, which isn't really neccessary because there aren't many for the period of time I am looking at.

For "Application" Events, all I have for sources are: gupdate, Defrag and VSS.
For "Security" Events, all I have Task Category are: Special Logon and Logon.

As far as I can make out these are all automated features.
a c 228 $ Windows 7
July 26, 2012 2:14:10 PM

Events in the viewer won't tell you what a person is doing so you can't know what programs they used unless it crashes and leaves an event in the application log.

I think you're going to need a 3rd party program to do what you want.
!