Any way to find user logon history in Win XP Pro 2

[michko]

I've got a user (management) who is convinced that someone is logging into her pc after work hours. I don't find any extraneous user accounts, but she's not convinced. Does Win XP Pro keep a log of successful user logons? Thanks for any help.

 

[kippy13]

Hi,
If someone is logging onto his PC there would be a user profile on the PC.
C:\docs and settings........is there one there that you wouldnt expect?

***************************************
Looking for the best answers:
faq222-2244
Keeping your system clear of malware:
faq608-4650
***********************************
Dont forget to post back with the eventual resolution.
***************************************

 

[michko]

Nope, no unexpected user id's, and I've changed her password, but the user is still insistent "someone" is using her pc. She insists Win XP Pro should keep track of who logs on and when, and wants to see the "tracking file". I just don't know if XP does track logon info or not. If so, great, should settle the issue, if not, then I'll look into some kind of tracking software.
Thanks

 

[kippy13]

Right click my computer/manage/event viewer/security.
I think you can see a history of the logins there. You will need administrative rights on the machine to view this though.

***************************************
Looking for the best answers:
faq222-2244
Keeping your system clear of malware:
faq608-4650
***********************************
Dont forget to post back with the eventual resolution.
***************************************

 

[michko]

No login history under security, but application and system (both under event viewer) show action on the pc. Since neither one shows any pc activity during times she's not logged on, I think she's finally convinced no one else is using it. Should of thought of looking there myself.
Thanks for the help.

 

[kippy13]

I knew that,
I had though that the security tab would show login history-oh well.


***************************************
Looking for the best answers:
faq222-2244
Keeping your system clear of malware:
faq608-4650
***********************************
Dont forget to post back with the eventual resolution.
***************************************

 

[bcastner]

1. Start / Run / gpedit.msc / OK.

2. Navigate to Local Computer Policy \ Computer Configuration \ Windows Settings \ Security Settings \ Local Policy \ Audit Policy

3. Double-click Audit logon events and enable the Success and Failure boxes.

4. Press OK.

If they have her password, at least a successful logon event will be recorded after hours.

I would implement for her a mandatory password ageing, password complexity policy as well.

 

[michko]

Guess I'll set up the Audit log to track logons, should put the final nail in this issue. Thanks for showing me how.

 

[bcastner]

Well, the Security tab was a non-starter.

Glad it helped,
Bill Castner