How to tell if somebody used my PC when I was away?

[Anonymous]

Does Windows MM store things like the date of last boot/login?
Is there a text log file that has this?
I presume that by looking at modification date of certain files,
that an expert can tell if somebody else was meddling with
your PC, but is there an easy way for Joe Sixpack to find out?

 

[Pegasus [MVP]]

Does Windows MM store things like the date of last boot/login?
Is there a text log file that has this?
I presume that by looking at modification date of certain files,
that an expert can tell if somebody else was meddling with
your PC, but is there an easy way for Joe Sixpack to find out?

Click Start / Run / eventvwr.exe {OK}, then examine the Security branch. It
contains numerous references about logon events.

 

[Sid Elbow]

I presume that by looking at modification date of certain files,
that an expert can tell if somebody else was meddling with
your PC, but is there an easy way for Joe Sixpack to find out?

I see Pegasus has told you the official way to do this but when I used
to want to check on my office machine after I'd been away for a day or
two I'd go to the search window and search by date (with the search
string box empty). Then sort on the <modified> column if necessary.

 

[Pegasus [MVP]]

I see Pegasus has told you the official way to do this but when I used to
want to check on my office machine after I'd been away for a day or two
I'd go to the search window and search by date (with the search string box
empty). Then sort on the <modified> column if necessary.

Official? I'm a pragmatic and when I find a better method (e.g. yours) then
I will immediately adopt it!

 

[Sid Elbow]

Official? I'm a pragmatic and when I find a better method (e.g. yours) then
I will immediately adopt it!

You don't know how pleased I am that you said that. You have helped me
so much over the years (I think of you as BAT-man )and I never
thought I'd ever return something useful, even in this tiny fashion.

 

[nesredep egrob]

Click Start / Run / eventvwr.exe {OK}, then examine the Security branch. It
contains numerous references about logon events.

I am now on XP pro sp3 - I had a look just to see what is there and it was
empty.
However System and Application gave me all I wanted.

Børge in sunny Perth, Australia

 

[Mathias Rissler]

Hello Anonymous,

you can always look up the event viewer. On a start up there ALWAYS is
something logged. In the case you weren't near your machine, it obviously
has been started without your permission.

START --> Run --> eventvwr.msc