1

I want to get unique logon & log off event from my pc. In the event viewer i can see more then one entry for login & log out event. I check most of the event details but could not found unique event for logged in by user.

http://www.freeimagehosting.net/uploads/bf1f69599d.gif

Evan Anderson
  • 141,071
  • 19
  • 191
  • 328
Pragnesh
  • 111
  • 1

1 Answers1

1

Your logon events are unique. You're just not looking at the unique data.

Each event with ID 4624 will contain, in the description, a logon ID (and, if it's a domain logon, a logon GUID), username, and a raft of other detail information.

To correlate a logoff event (event ID 4634) with a logon, you'll need to examine the description of the logoff event and correlate the logon ID there with the logon IDs logged when logon events occur.

Evan Anderson
  • 141,071
  • 19
  • 191
  • 328