Right click the system event and click refresh, might help if you clear the application event log too as it seems this might happen when your logs are full.
Actually i think i need to correct myself abit; correct event to look for would be: Event code 6005 - as this shows exactly when the eventlogger starts to run. To see when the machine has been shut down you can look for; Event code 6006.
Last edited by latitude; Aug 15 '07, 11:24 AM.
Reason: addendum
Right click the system event and click refresh, might help if you clear the application event log too as it seems this might happen when your logs are full.
Actually i think i need to correct myself abit; correct event to look for would be: Event code 6005 - as this shows exactly when the eventlogger starts to run. To see when the machine has been shut down you can look for; Event code 6006.
Event codes 6005 and 6006 tells you windows start and shutdown time.
Is there a way to see log-on and log-off time?
i dont think eventviewer shows this information?
Also, these startup and shutdown logs are for the PC , not for the logon itself. I mean if you want to check which user logged on or logged-off at what time, the event viewer wont't give this information !
How would we do that?
Originally posted by latitude
Right click the system event and click refresh, might help if you clear the application event log too as it seems this might happen when your logs are full.
Actually i think i need to correct myself abit; correct event to look for would be: Event code 6005 - as this shows exactly when the eventlogger starts to run. To see when the machine has been shut down you can look for; Event code 6006.
Last edited by questionit; Aug 15 '07, 01:38 PM.
Reason: addendum
WMI seems like the way to go. Sorry that I can't translate this into widows scrip, but in python it would look like this:
List Logon Session Information
Description
Returns information about logon sessions associated with the user currently logged on to a computer. [CODE=python]import win32com.client
strComputer = "."
objWMIService = win32com.client .Dispatch("Wbem Scripting.SWbem Locator")
objSWbemService s = objWMIService.C onnectServer(st rComputer,"root \cimv2")
colItems = objSWbemService s.ExecQuery("Se lect * from Win32_LogonSess ion")
for objItem in colItems:
print "Authentica tion Package: ", objItem.Authent icationPackage
print "Caption: ", objItem.Caption
print "Descriptio n: ", objItem.Descrip tion
print "Install Date: ", objItem.Install Date
print "Logon Id: ", objItem.LogonId
print "Logon Type: ", objItem.LogonTy pe
print "Name: ", objItem.Name
print "Start Time: ", objItem.StartTi me
print "Status: ", objItem.Status[/CODE]
Comment