0

I thought this is a pretty simple task, but apparently not.

Windows 10 Pro, standalone on a home network. There are several accounts on this system.

I am trying to find when a given user account has logged onto this system. I see tons of "logon" and "special logon" events (and I mean LOTS of them) around the time when I know the user login event has occurred. But there's no mention anywhere of the actual username. Or the event viewer claims that the account name is SYSTEM or the actual hostname of the machine. There's no mention of the one thing I need: the actual username that has performed the logon. These logs could not be less helpful this way.

What am I missing?

Florin Andrei
  • 1,087

1 Answers1

0

To trace logon/off history of a user accout, please also check this script, which can also query the remote computer to get the user's logon/off history:

Please refer to this thread:

https://social.technet.microsoft.com/Forums/lync/en-US/4f6815f1-2998-484c-a423-fe6507f1548c/powershell-script-to-fetch-logonlogoff-user-on-particular-server-getwinevent-geteventlog?forum=winserverpowershell

Kattee Lee
  • 657