How to tell if somebody used my PC when I was away?

  • Thread starter Thread starter Anonymous
  • Start date Start date
A

Anonymous

Does Windows MM store things like the date of last boot/login?
Is there a text log file that has this?
I presume that by looking at modification date of certain files,
that an expert can tell if somebody else was meddling with
your PC, but is there an easy way for Joe Sixpack to find out?
 
Anonymous said:
Does Windows MM store things like the date of last boot/login?
Is there a text log file that has this?
I presume that by looking at modification date of certain files,
that an expert can tell if somebody else was meddling with
your PC, but is there an easy way for Joe Sixpack to find out?
Click to expand...

Click Start / Run / eventvwr.exe {OK}, then examine the Security branch. It
contains numerous references about logon events.
 
Anonymous said:
I presume that by looking at modification date of certain files,
that an expert can tell if somebody else was meddling with
your PC, but is there an easy way for Joe Sixpack to find out?
Click to expand...


I see Pegasus has told you the official way to do this but when I used
to want to check on my office machine after I'd been away for a day or
two I'd go to the search window and search by date (with the search
string box empty). Then sort on the <modified> column if necessary.
 
Sid Elbow said:
I see Pegasus has told you the official way to do this but when I used to
want to check on my office machine after I'd been away for a day or two
I'd go to the search window and search by date (with the search string box
empty). Then sort on the <modified> column if necessary.
Click to expand...

Official? I'm a pragmatic and when I find a better method (e.g. yours) then
I will immediately adopt it!
 
Official? I'm a pragmatic and when I find a better method (e.g. yours) then
I will immediately adopt it!
Click to expand...

You don't know how pleased I am that you said that. You have helped me
so much over the years (I think of you as BAT-man :-) )and I never
thought I'd ever return something useful, even in this tiny fashion.
 
Click Start / Run / eventvwr.exe {OK}, then examine the Security branch. It
contains numerous references about logon events.
Click to expand...

I am now on XP pro sp3 - I had a look just to see what is there and it was
empty.
However System and Application gave me all I wanted.

Børge in sunny Perth, Australia
 
Hello Anonymous,

you can always look up the event viewer. On a start up there ALWAYS is
something logged. In the case you weren't near your machine, it obviously
has been started without your permission.

START --> Run --> eventvwr.msc
 
Back
Top