Snazy

Right a quick one for you.
Arguements at work, about someone claiming they are starting way before anyone believes they are.

Rather than setting up webcams, motion detectors, pressure mats and all the MI stuff, lol, is there anywhere to look in Win XP that will show what time/date someone logged into the PC?

The work settings on the PC's auto log you out after 20 mins, so by the morning he would have to log on.

Is it recorded anywhere easy to find/read?
Or are there any recommended apps that work in the background that would also log this?

Causing massive arguements at the mo, as he is accruing a day off in lieu every 4 days !

Andy Tang

iTrader: (3)

Have a chat with your administrator, as the PC is probably logging on to a Windows server. The administrator needs to enable logging on the server to record this.

Snazy

Is there no local machine log at all ?

Davey P

iTrader: (1)

Try taking a look in Event Viewer under the Security section.

Mr-Confused

Tricky one to prove. My machine at work stays logged in for weeks at a time and I am often using RDP at all times of the day to get back to it, even overnight.

Check the time stamps on some of the files that are being accessed, it may be a more reliable way to check to see if this person is actually working...

boxst

Just to qualify my answer: I'm old!

In the past, I have just written a small batch file that executes on windows startup and appends to a log file. Something like:

Creates in the file:

User Logged In At 2009-10-05 20:09
User Logged In At 2009-10-05 20:09
User Logged In At 2009-10-05 20:10
User Logged In At 2009-10-05 20:10

Snazy

Cheers guys, some great info and some eye openers there Thank you.

Boxst, thats about all I would need really. Its just to satisfy our twisted minds that he is bull$hitting his start time.

I mean, 9am start, but turns up and "starts work" at 7.15 each day. Just happens to be responsible for entering the departments hours into the system, so can put whatever he wants for himself.
Seems to have had about 8 weeks holiday/ lieu time already this year... See where im coming from lol

hodgy0_2

just one thing you have to be carefull off - and that is be sure what you are auditing - logging onto the domain or the local machine

I am pretty sure that if you log onto a pc -- but have the domain listed -- in reality you are logging onto the domain not the pc itself - so any domain logon from the account would show up in the domain controllers security logs --it would be account specific not computer specific -- so if he can logon to the domain remotely it will skew the outcome coz he could be doing it from anywhere

i don't think a local security log would log a domain logon

warrenm2

net user <username> /domain gives last logon time (assuming you have permissions). But as mentioned previously useless if they just lock their machine....

boxst

If you want to stop them leaving their machine on, just put a scheduled task to run at 1am to 'shutdown -s -f'.

They will get in the habit of switching off the computer and saving work if every morning it is switched off.

Steve

kingofturds

iTrader: (1)

Set up a camera, he is probably getting in early to crack one off over some naaaasssssssty ****. That is the only reason I'd turn up nearly 2 hours early for work each day

The Rig

iTrader: (13)

For a nice n easy check,when you log on this will be in the event view as an eventlog within system,so if the machine has been off this is the 1st service/event log entry and should have the time 07:15 next to it (or the real time he logs on)




Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Multiprocessor Free.

For more information, see Help and Support Center at Events and Errors Message Center: Basic Search.