Windows Vista forum

General discussion

How Can I view login history to see dates, times, ID's

by spellmanjudy / January 2, 2009 2:24 AM PST

I need to compile a list of login dates and times a particular user logged into a pc running Windows Vista. Old os had a file under Windows Explorer, Windows File that would list by date and time. Can I do the same thing with Vista?

Post a reply
Discussion is locked
You are posting a reply to: How Can I view login history to see dates, times, ID's
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: How Can I view login history to see dates, times, ID's
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Check the event viewer
by alakzam / January 2, 2009 11:22 AM PST

If that doesn't have the info you're looking for, you'll have to install a third party program, and it will only be able to track from the moment it was installed forward.

Collapse -
if you like to tinker with xml
by ramarc / January 3, 2009 2:06 AM PST

you can create a custom view in Event Viewer.

In the filter, choose By Log and select Windows Log/Security. Include Event IDs: 4624-4634 and choose Keyword: Audit Success.

Do not enter a User, since logon/logff events are system level and the user is embedded in the event details.

After filtering, you can export the log or copy the details to an XML file that will be similar to this.

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 1/2/2009 1:03:03 PM
Event ID: 4634
Task Category: Logoff
Level: Information
Keywords: Audit Success
User: N/A
Computer: ***PC NAME***
An account was logged off.

Security ID: ***PC NAME***\***USER NAME***
Account Name: ***USER NAME***
Account Domain: ***PC NAME***
Logon ID: 0x9de0023

Logon Type: 7

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Event Xml:
<Event xmlns="">
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<TimeCreated SystemTime="2009-01-02T18:03:03.494Z" />
<Correlation />
<Execution ProcessID="764" ThreadID="5080" />
<Computer>***PC NAME***</Computer>
<Security />
<Data Name="TargetUserSid">S-1-5-21-462670967-2077919064-3267070267-1000</Data>
<Data Name="TargetUserName">***USER NAME***</Data>
<Data Name="TargetDomainName">***PC NAME***</Data>
<Data Name="TargetLogonId">0x9de0023</Data>
<Data Name="LogonType">7</Data>

here are a couple of articles to check out:

Popular Forums
Computer Help 49,613 discussions
Computer Newbies 10,349 discussions
Laptops 19,436 discussions
Security 30,426 discussions
TVs & Home Theaters 20,308 discussions
Windows 10 360 discussions
Phones 15,802 discussions
Windows 7 7,351 discussions
Networking & Wireless 14,641 discussions

CNET Holiday Gift Guide

Looking for great gifts under $100?

Trendy tech gifts don't require a hefty price tag. Choose from these CNET-recommended useful and high-quality gadgets.