I use Windows Server 2008 at my workstation and sometimes work from home. Is there an easy way of viewing the login and logoff times from the event viewer so I can see how many hours I was logged in or simply to find out when I started working? Preferably another application with an easier interface than manually looking at the event viewer, which is cluttered even after filtering out other unrelated events.


As you are no doubt aware, the event logs are anything but easy to read. I suggest you create logon and logoff scripts to record the times into a separate log file.


Here is a nice explanation for making quite powerful filters: http://blogs.technet.com/b/askds/archive/2011/09/26/advanced-xml-filtering-in-the-windows-event-viewer.aspx You can afterwards export the data to excel and work with it.


Answer for a domain environment.

Install additional account info dll on your dc. http://www.windowsitpro.com/article/tips/jsi-tip-8045-how-can-i-add-an-additional-account-info-tab-to-the-user-properties-of-active-directory-users-and-computers-.aspx

Very easy to view the info there, but remember account logon info is specific to each DC so make sure to query each of them.

  • 1
    In 2008 domain there is no need for that FYI, they've added the Attribute Editor tab in ADUC to show the same or similar things. all the properties of an object can be found there.
    – Jordan W.
    Feb 10 '11 at 22:43

You could follow this: http://teusje.wordpress.com/2012/09/11/windows-server-logging-users-logon-and-logoff-via-powershell/

Eventually you could write the info in one log so that you see the logon/logoff time in the same file. When you logoff you could also extend the powershell script read the log file, search for your last login time, parsing the time and measuring the difference and write it also to the log.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.