How to get login and log off reports of a user in Windows server or Workstation?
Wahtever we do on a system it is going to restore the history of that event and that we can viewed with Event Viewer. Every event has a different ID.
For logging in to the system it has the Event ID 2 and ID 3 for logging off from the system. It stores the data like: -
| Log Name |
| Source |
| Event ID |
| Level |
| User |
| OpCode |
| Logged |
| Computer |
Location to get the Event ID log history:
- Open Event Viewer
- Applications and Services log
- Microsoft
- Windows
- User Profile Service
Click on Operational and from the right pane you will see the event ID related to this particular Event group.
From the Action part you can filter the event IDs to get the clear reports.
| Event ID 2 | This will show you the login details |
| Event ID 3 | This will show you the log off details |
By default it store the data upto 4096KB and that might not be enough to keep more data. So, in this scenario we can modify the maximum log size. For that we need click on Properties from the Action part and then we can modify it very easily.
In case there is only need to have the last login report of a user we can go ahead with a normal command process that will also help you a lot.
Here is the process with command you could follow to get that information.
- Open Command Prompt (Run as administrator)
- Type Net user username
- Enter
If the username is something different format like AJ Tiwari then there is a little change that we need to make in the command is Net user "AJ Tiwari"
0 Comments:
Post a Comment