I want to get unique logon & log off event from my pc. In the event viewer i can see more then one entry for login & log out event. I check most of the event details but could not found unique event for logged in by user.
Asked
Active
Viewed 583 times
1 Answers
1
Your logon events are unique. You're just not looking at the unique data.
Each event with ID 4624 will contain, in the description, a logon ID (and, if it's a domain logon, a logon GUID), username, and a raft of other detail information.
To correlate a logoff event (event ID 4634) with a logon, you'll need to examine the description of the logoff event and correlate the logon ID there with the logon IDs logged when logon events occur.
Evan Anderson
- 141,071
- 19
- 191
- 328