time spent after logon

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • questionit
    Contributor
    • Feb 2007
    • 553

    time spent after logon

    Can anyone tell me how to check how long you have been logged on the Windows account ?

    Thanks
    Qi
  • latitude
    New Member
    • Nov 2006
    • 50

    #2
    Guess one way to do this would be through the event viewer - system; try looking for event code 7035, 7036.

    Comment

    • questionit
      Contributor
      • Feb 2007
      • 553

      #3
      Hi latitude

      i opened event viewer but there is nothing in System Log - i can see everything in Application Log ..

      Can you think of any reason why?
      Originally posted by latitude
      Guess one way to do this would be through the event viewer - system; try looking for event code 7035, 7036.

      Comment

      • latitude
        New Member
        • Nov 2006
        • 50

        #4
        Right click the system event and click refresh, might help if you clear the application event log too as it seems this might happen when your logs are full.

        Actually i think i need to correct myself abit; correct event to look for would be: Event code 6005 - as this shows exactly when the eventlogger starts to run. To see when the machine has been shut down you can look for; Event code 6006.
        Last edited by latitude; Aug 15 '07, 11:24 AM. Reason: addendum

        Comment

        • questionit
          Contributor
          • Feb 2007
          • 553

          #5
          That's great

          Thanks

          Originally posted by latitude
          Right click the system event and click refresh, might help if you clear the application event log too as it seems this might happen when your logs are full.

          Actually i think i need to correct myself abit; correct event to look for would be: Event code 6005 - as this shows exactly when the eventlogger starts to run. To see when the machine has been shut down you can look for; Event code 6006.

          Comment

          • questionit
            Contributor
            • Feb 2007
            • 553

            #6
            Lattitude

            Event codes 6005 and 6006 tells you windows start and shutdown time.
            Is there a way to see log-on and log-off time?

            i dont think eventviewer shows this information?

            Also, these startup and shutdown logs are for the PC , not for the logon itself. I mean if you want to check which user logged on or logged-off at what time, the event viewer wont't give this information !

            How would we do that?



            Originally posted by latitude
            Right click the system event and click refresh, might help if you clear the application event log too as it seems this might happen when your logs are full.

            Actually i think i need to correct myself abit; correct event to look for would be: Event code 6005 - as this shows exactly when the eventlogger starts to run. To see when the machine has been shut down you can look for; Event code 6006.
            Last edited by questionit; Aug 15 '07, 01:38 PM. Reason: addendum

            Comment

            • Rabbit
              Recognized Expert MVP
              • Jan 2007
              • 12517

              #7
              You'll have to turn on the security log. This log can keep track of failed log-ins, successful log-ins, and log-outs.

              Comment

              • bartonc
                Recognized Expert Expert
                • Sep 2006
                • 6478

                #8
                WMI seems like the way to go. Sorry that I can't translate this into widows scrip, but in python it would look like this:
                List Logon Session Information

                Description

                Returns information about logon sessions associated with the user currently logged on to a computer. [CODE=python]import win32com.client
                strComputer = "."
                objWMIService = win32com.client .Dispatch("Wbem Scripting.SWbem Locator")
                objSWbemService s = objWMIService.C onnectServer(st rComputer,"root \cimv2")
                colItems = objSWbemService s.ExecQuery("Se lect * from Win32_LogonSess ion")
                for objItem in colItems:
                print "Authentica tion Package: ", objItem.Authent icationPackage
                print "Caption: ", objItem.Caption
                print "Descriptio n: ", objItem.Descrip tion
                print "Install Date: ", objItem.Install Date
                print "Logon Id: ", objItem.LogonId
                print "Logon Type: ", objItem.LogonTy pe
                print "Name: ", objItem.Name
                print "Start Time: ", objItem.StartTi me
                print "Status: ", objItem.Status[/CODE]

                Comment

                Working...