Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to get unique logon & log off event from my pc. In the event viewer i can see more then one entry for login & log out event. I check most of the event details but could not found unique event for logged in by user.

share|improve this question

Your logon events are unique. You're just not looking at the unique data.

Each event with ID 4624 will contain, in the description, a logon ID (and, if it's a domain logon, a logon GUID), username, and a raft of other detail information.

To correlate a logoff event (event ID 4634) with a logon, you'll need to examine the description of the logoff event and correlate the logon ID there with the logon IDs logged when logon events occur.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.