How can I get the latest shut downs/starts/logins/log-outs in Windows 10?

rodion15

Distinguished
Sep 11, 2011
477
0
18,810
Best answers
5
How can I get the latest shut downs/starts/logins/log-outs / unsucessful logins in Windows 10?

I've read a few articles I found but I couldn't find a good answer.

for example: I went to event viewer > security:
I read that the eventID 4624 is a successful sign-in, which seems incorrect, look at this test:
- I shut down my computer at 08:08:30
- I started my computer at 08:10:39 (give or take 5 seconds)
- I signed in at 08:12:10 (entered my password and hit enter)

...yet, at 08:10:39 I can see event 4624 registered, how's this possible if I signed in later at 08:12:10?
 

rodion15

Distinguished
Sep 11, 2011
477
0
18,810
Best answers
5


Thanks for your answer. As I said I've already tried that.
 

Phillip Corcoran

Titan
Moderator
Sep 7, 2013
22,692
110
114,790
Best answers
7,888
"...yet, at 08:10:39 I can see event 4624 registered, how's this possible if I signed in later at 08:12:10?"


You don't have to be actually signed in for Windows events to occur and be recorded in the logs. Windows events can occur and be recorded as soon as Windows has loaded to the sign-in screen, because at that point the Windows shell is running.
 

terry4536

Glorious
Mar 28, 2010
9,742
1
45,560
Best answers
1,330


You asked about about the log of windows events and services. The event viewer is the place to look (and the only place I know of to look).

 

rodion15

Distinguished
Sep 11, 2011
477
0
18,810
Best answers
5


What I need is the time I choose an account, enter my password and sign in. Even when I look "Friendly View" on the "Details" tab in Event Viewer this is the TargetUserName value I can see several "false" log ins into my account before the real one took place.
 

terry4536

Glorious
Mar 28, 2010
9,742
1
45,560
Best answers
1,330


Code:
How can I get the latest shut downs/starts/logins/log-outs / unsucessful logins in Windows 10?
In the above linked "How to Read Logoff and Sign Out Logs in Event Viewer in Windows" using the Filter Current Log menu item, there is an option at the top to specify the logged event time period. I would use that to narrow the events to the " latest shut downs/starts/logins/log-outs in Windows 10" in addition to the specific event code.

Filter Current Log :
https://www.tenforums.com/tutorials/117980-read-logoff-sign-out-logs-event-viewer-windows.html

Event Codes:
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-logonlogoff-events

 

ASK THE COMMUNITY

TRENDING THREADS