Finding when a users ogs on and off?

Question

SnoopMarkyIOM wrote:
Get-EventLog : Requested registry access is not allowed.Open your powershell console as Admin :D

Answer 1

Powershell will be your friend :)If you are in a domain with a Windows DC, you can check (if enabled) the AD auditing security logs. Or you can check inside the security log of the computer.
First of all, login, logout then log in your session again to have recent entries in the event logs with the opening / closing session.Note the Event IDs of those actions as they will be needed.Open a Powershell console on the computer, then type this :PowershellGet-EventLog -InstanceId login_event_id -LogName Security | Where-Object {$_.Message -like "*user_sam_accountname*"}
(obviously, replace login_event_id by the number of the event and samaccountname by the sam account name of the user)
Do it for login and logouts, and you will have your dates.
If you want to not be bothered anymore by this kind of things, I made an How-To allowing to know who is...