Tech Support Guy banner
Status
Not open for further replies.

Solved: Logon / Logoff Times !!

4K views 5 replies 4 participants last post by  Kity 
#1 ·
Hi All,

I have been using the PC for a long time, but since of late I am
concerned of keep track of the Computer usage. Appreciate if anyone
could let me know the following.

A> Keep track of the Logon / Logoff times of the Computer.

B> What applications have been opened and closed.

With regard to the abvoe. Kindly let me know if there are free software
that do this job for me. Or whether the system itself is able to the job.

Your Comments would be much appreciated. THanks

Best Regards
 
#2 ·
Event Viewer will tell you a great deal. Other than that, and for more detail, you may need to install spy software or tracking software.

A simple search for files that were accessed within a particular time-frame will tell you a great deal. Agent Ransack has options for searching for all files modified within a chosen time-frame.
 
#3 ·
Hi Elvandil,

Yes .. Thanks for your Prompt response. Noted that Event viewer will give details, but the possibility of tracking all events is not avail with event viewer. It will give logon / Logoff times, what happened inbetween is not avail and not understandable.

As suggested by you, its seems that the tracking software would be best ideal. Do you have any suggestions of any tracking software that is ideal for this activity that you could recomend.

Or is there any way, that we could add snap ins to the event viewer and get it to do the job.

Kindly advise with your comments. Thanks Again

Best Regards
 
#4 ·
You can track programs accessed thru Event Viewer too. First, you have choose which programs to track. For exmple, lets say you want to keep track of whenever someone uses the command prompt, which is CMD.EXE.

You right click on cmd.exe, > properties > Security tab > Advanced > Auditing tab > Continue > Add button > add "Everyone" as the user name > Then at following screen, select "Traverse folder/execute file. OK and Apply.

Then you need to turn on Auditing for Object Access.
Administrative Tools > Local Security Policy. Local Policies > Audit Policy > Audit Object Access > checkmark 'Success'.

Then you can create a custom filter in Event Viewer for these Event IDs: 4663, 4656

You should also increase the size of the Security Log, because object access audits can fill up the log fast, and will 'scroll' the log so that older entries disappear.
 
Status
Not open for further replies.
You have insufficient privileges to reply here.
Top