PC on/off activity log

Sandycheeks · 23 Mar 2015 at 15:05

Is there such a thing ?
Basically I want to check when a PC has been turned on/off and active/idle.
Preferably over the course of a week or so but daily would suffice.
Thanks

Not sure where this should go

craig_t · 23 Mar 2015 at 15:43

How do you define active/idle? As in your CPU is doing something, or someone is actually using the computer?

The event log will log any shutdown/startup events, so you can filter that, you could even set up a logparser command to get everything you want out from 1 click.

Idle/Active depends on the above, what you class it as. But you could set it to go to sleep after X minutes of not being used, so that it would again be logged in the event log?

Sandycheeks · 23 Mar 2015 at 15:59

Basically I want to know if someone has used a pc and for how long and doing what.
Don't want or need to see specifics but what apps and programmes launched and at what time.
BTW Windows 7 pro.

TL;DR

I suspect my lad had been on the PC in the early hours and want to find out, obviously I have asked but not satisfied with the answer.
He's a good lad, just a bit too into PC gaming atm.

ED209 · 23 Mar 2015 at 16:03

look through event viewer.

if you turn your PC off once you have finished with it and someone has been on the PC at like 3am you will see normal services etc start up at silly times of the morning.

I cant think of any software that will do the monitoring for you and what has been done but the event logs will show if its been on between you shutting it down and then you turning it on in the morning

event viewer is all time stamped

either that or stick a password on the windows user account then he cant do anything without you knowing lol

Sandycheeks · 23 Mar 2015 at 16:08

ED209 said:
look through event viewer.

if you turn your PC off once you have finished with it and someone has been on the PC at like 3am you will see normal services etc start up at silly times of the morning.

I cant think of any software that will do the monitoring for you and what has been done but the event logs will show if its been on between you shutting it down and then you turning it on in the morning

event viewer is all time stamped

either that or stick a password on the windows user account then he cant do anything without you knowing lol

What do I look for though, I've had a brief look but not sure where to start.
I'll have a closer look when I get home.

craig_t · 23 Mar 2015 at 16:15

First of all, with no specifics on event log ID's... If you think he is using the PC at 3AM, if there is anything logged in the Application/Security/System log at that time, the PC was on... I assume, it is to be turned off when not in use? This would go back to my suggestion earlier of setting it to sleep/hibernate with X minutes inactivity.

So, as an example I took my work laptop out of sleep this morning and got event ID 1 in the system log:
The system has resumed from sleep.

Sleep Time: ‎2015‎-‎03‎-‎21T02:01:33.845255500Z
Wake Time: ‎2015‎-‎03‎-‎23T10:04:17.467201700Z

Wake Source: Power Button

Event ID 42 for entering sleep:
The system is entering sleep.

Or a shutdown event ID 1074:
The process C:\Windows\system32\winlogon.exe (MC0WMUJC) has initiated the power off of computer MC0WMUJC on behalf of user Craig for the following reason: No title for this reason could be found

Or event ID 12 for a startup:
The operating system started at system time ‎2015‎-‎03‎-‎19T10:49:27.109999300Z.

Hopefully that helps a little?

Sandycheeks · 23 Mar 2015 at 17:22

Thanks,
All sorted now - the on / off will do.
I suspected my lad of going back on his PC in the night which he hasn't but it did show me that he has been on the PC all day today although he is off school with a migraine (the thing that originally aroused my suspicions)

cats_five · 24 Mar 2015 at 06:29

I think if he is well enough to be on his PC all day he is well enough to be at school. Run that idea past him.

Karateyid · 24 Mar 2015 at 09:45

Who do you have broadband with?? I know some will allow you to put a time limit on the Internet. So you can cut off the connection between certain hours. However won't get around him playing offline I guess.

Sandycheeks · 24 Mar 2015 at 10:14

Don't want to have to put a limit on t'internet.
TBH I put 2 and 2 together and come up with 5, yeah he shouldn't really have been playing all day whilst off school with a migraine but at 14 could you have resisted - He did actually have a migraine. I'm amazed he lasted until 11:04 before he turned the PC on....I'd have turned it on the minute the front door was shut.
His only crime here was to prolong his migraine by staring at a monitor.