In this guide i will explain How to Know If Someone Used Your PC during
your Absence and When? While you could always set a password or install
something like Prey ahead of time, you might be in a position where you
suspect someone's already used your computer without your permission.
Checking your computer's built-in logs is a great way to do that after the fact.
So lets start:
Method 1 :- Windows Default Logon Auditing
First you need to be enable the logon auditing on your computer through this:
After enabling this setting, Windows will log logon events – including a
username and time – to the system security log.To view these events:
WinLogOnView is a simple tool for Windows Vista/7/8/2008 that analyses the
security event log of Windows operating system, and detects the date/time
that users logged on and logged off. For every time that a user log on/log off
to your system, the following information is displayed: Logon ID, User Name,
Domain, Computer, Logon Time, Logoff Time, Duration, and network address.
WinLogOnView also allows you to easily export the logon sessions
information to tab-delimited/comma-delimited/html/xml file.
and this is considered easier than the other as shown in the previous screen
shot.
Download WinLogOnView
your Absence and When? While you could always set a password or install
something like Prey ahead of time, you might be in a position where you
suspect someone's already used your computer without your permission.
Checking your computer's built-in logs is a great way to do that after the fact.
So lets start:
Method 1 :- Windows Default Logon Auditing
First you need to be enable the logon auditing on your computer through this:
- Open "start menu">>Type "run"(or press windows key+R) and press
"enter" and this box will pop up:
- In this box write secpol.msc and navigate to "Local Policies" and choose
"Audit Policy".
- In the right-pane side select the “Audit logon events ” and enable both
Success and failure option. Click on Apply the settings.
username and time – to the system security log.To view these events:
- Open the Event Viewer through opening start menu type "event viewer"
and press enter to open. - Navigate to the Windows Logs.
- Then search for Security category in the event viewer.
Look for events with event ID 4624 – these represent successful login
events.
To see more information – such as the user account that logged into the
computer – you can double-click the event and scroll down in the text box.
Method 2 :- Use the Tool WInLogOnViewevents.
To see more information – such as the user account that logged into the
computer – you can double-click the event and scroll down in the text box.
WinLogOnView is a simple tool for Windows Vista/7/8/2008 that analyses the
security event log of Windows operating system, and detects the date/time
that users logged on and logged off. For every time that a user log on/log off
to your system, the following information is displayed: Logon ID, User Name,
Domain, Computer, Logon Time, Logoff Time, Duration, and network address.
WinLogOnView also allows you to easily export the logon sessions
information to tab-delimited/comma-delimited/html/xml file.
and this is considered easier than the other as shown in the previous screen
shot.
Download WinLogOnView
0 comments:
Post a Comment