0

I am working with my computer (Windows 10 Enterprise), sometimes during the day and sometimes during the night. I don't switch off my computer when I go at home.

Is there a way (like in the event viewer) to know when my computer has been actively used? I mean, even when a computer is not used, some entries are entered in the event viewer anyway. I would like to know on what events to filter on "real" user interaction activities.

Does anybody have an idea?
Thanks in advance

Improve this question
2
  • Filter the event log for login and logout events, where the security ID is your user.
    – spikey_richie
    Commented Jan 27, 2022 at 15:45
  • Do you know the event IDs?
    – Dominique
    Commented Jan 27, 2022 at 17:17

1 Answer 1

Reset to default
2

You could use the Windows security log and filter it e.g. using Powershell. I assume it shows the time when the lock screen is unlocked. Depending on lock time out of your system the number of events per day may vary:

Get-WinEvent -FilterHashtable @{logname='security'; id=4672 }  | where-object  { $_.Message -like '*myusername*' }

Tested for an Windows domain account named myusername on a system that runs 24/7.

Improve this answer
2
  • Sorry for the late reply. Your command looks fine, but only the last events seem to be present, so I have the impression that the event logs get cleaned. Are you are aware of any automatical backups or copies of the event logs and where to find them?
    – Dominique
    Commented Apr 19, 2022 at 8:12
  • @Dominique If the configured security event log size is too small then the events are gone. I am not aware of an automated event log export of Windows, may be there are third party tools that do export and clear events.
    – Robert
    Commented Apr 19, 2022 at 8:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .