General discussion

Login activity

Is there a way to check login activity for different users, including the administrator in XP? I am thinking that my ex-girlfriend got into my computer but I can't tell if she logged in or not and I'd like to know if there is a place where login history or activity is collected.


Discussion is locked
Reply to: Login activity
PLEASE NOTE: Do not post advertisements, offensive materials, profanity, or personal attacks. Please remember to be considerate of other members. If you are new to the CNET Forums, please read our CNET Forums FAQ. All submitted content is subject to our Terms of Use.
Reporting: Login activity
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
- Collapse -

Logon as admin, open event viewer from admin tools, choose security, view, filter, set event source to security, and category to logon. On this list, right click the top entry, choose properties and use the up/down arrow to scroll thru and see who the user was.

- Collapse -
Kono, I just curious...

You said:

'On this list, right click the top entry, choose properties and use the up/down arrow to scroll thru and see who the user was.'

What list, what top entry?

- Collapse -
no log list

Thanks for your answer. This worked on one of my computers. When I went to security a list was generated and then I was able to filter it. The other computer however, had no entries under security. Is there something turned off for this to happen? Why was there nothing in the security list?
Thanks again

- Collapse -
Enable it

If your using XP Pro you might check local security policy, expand the local policies node, click audit policy and right click audit account logon events. Choose properties and then check mark success/failure. If your using Home edition and nothing is listed under security of event viewer, right click security, on the general tab, check "modified" date. You'll know if changes have been made recently, i.e. someone cleared it.

CNET Forums