Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to get unique logon & log off event from my pc. In the event viewer i can see more then one entry for login & log out event. I check most of the event details but could not found unique event for logged in by user.

share|improve this question
add comment

1 Answer 1

Your logon events are unique. You're just not looking at the unique data.

Each event with ID 4624 will contain, in the description, a logon ID (and, if it's a domain logon, a logon GUID), username, and a raft of other detail information.

To correlate a logoff event (event ID 4634) with a logon, you'll need to examine the description of the logoff event and correlate the logon ID there with the logon IDs logged when logon events occur.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.