Windows Vista forum

General discussion

How Can I view login history to see dates, times, ID's

by spellmanjudy / January 2, 2009 2:24 AM PST

I need to compile a list of login dates and times a particular user logged into a pc running Windows Vista. Old os had a file under Windows Explorer, Windows File that would list by date and time. Can I do the same thing with Vista?
Thanks!

Post a reply
Discussion is locked
You are posting a reply to: How Can I view login history to see dates, times, ID's
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: How Can I view login history to see dates, times, ID's
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Check the event viewer
by alakzam / January 2, 2009 11:22 AM PST

If that doesn't have the info you're looking for, you'll have to install a third party program, and it will only be able to track from the moment it was installed forward.

Collapse -
if you like to tinker with xml
by ramarc / January 3, 2009 2:06 AM PST

you can create a custom view in Event Viewer.

In the filter, choose By Log and select Windows Log/Security. Include Event IDs: 4624-4634 and choose Keyword: Audit Success.

Do not enter a User, since logon/logff events are system level and the user is embedded in the event details.

After filtering, you can export the log or copy the details to an XML file that will be similar to this.

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 1/2/2009 1:03:03 PM
Event ID: 4634
Task Category: Logoff
Level: Information
Keywords: Audit Success
User: N/A
Computer: ***PC NAME***
Description:
An account was logged off.

Subject:
Security ID: ***PC NAME***\***USER NAME***
Account Name: ***USER NAME***
Account Domain: ***PC NAME***
Logon ID: 0x9de0023

Logon Type: 7

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4634</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12545</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2009-01-02T18:03:03.494Z" />
<EventRecordID>578613</EventRecordID>
<Correlation />
<Execution ProcessID="764" ThreadID="5080" />
<Channel>Security</Channel>
<Computer>***PC NAME***</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserSid">S-1-5-21-462670967-2077919064-3267070267-1000</Data>
<Data Name="TargetUserName">***USER NAME***</Data>
<Data Name="TargetDomainName">***PC NAME***</Data>
<Data Name="TargetLogonId">0x9de0023</Data>
<Data Name="LogonType">7</Data>
</EventData>
</Event>

here are a couple of articles to check out: http://www.computerperformance.co.uk/vista/vista_event_viewer.htm
http://www.windowsvistauserguide.com/event_viewer.htm

Popular Forums
icon
Computer Help 47,885 discussions
icon
Computer Newbies 10,322 discussions
icon
iPhones, iPods, & iPads 3,188 discussions
icon
Security 30,333 discussions
icon
TVs & Home Theaters 20,177 discussions
icon
HDTV Picture Setting 1,932 discussions
icon
Phones 15,713 discussions
icon
Windows 7 6,210 discussions
icon
Networking & Wireless 14,510 discussions

Big stars on small screens

Smosh tells CNET what it took to make it big online

Internet sensations Ian Hecox and Anthony Padilla discuss how YouTube has changed and why among all their goals, "real TV" isn't an ambition.