Windows Vista Forums
Vista Forums Home Join Vista Forums Windows 7 Forum Vista Tutorials Tags
Welcome to Windows Vista Forums. Our forum is dedicated to helping you find solutions with any problems, errors or issues you are experiencing with Windows Vista. The Vista forum also covers news and updates and has an extensive Windows Vista tutorial section that covers a wide range of tips and tricks.

Go Back   Vista Forums > Vista Newsgroups > Vista account administration

Vista - Windows Vista Event Viewer

Reply
 
Old 04-15-2008   #1 (permalink)
arash


 
 

Windows Vista Event Viewer

My Windows Vista Event Viewer used to log all logon and logoff events, and I
could audit all user account activities. But recently it just logs the logon
event for user accounts and doesn't show any logoff event. I know how to turn
on and off the auditing feature in Windows XP. But I can't find same thing in
Windows Vista. I will appreciate if someone helps me.

My System SpecsSystem Spec
Old 04-17-2008   #2 (permalink)
William Anderson


 
 

RE: Windows Vista Event Viewer

Hey there Arash,

This might sound dumb, but try right clicking on the security log and see if
you have the option to clear the filter. Do that and then check for 4634
events.

Let me know if it works.

Best Regards,

Will

"arash" wrote:
Quote:

> My Windows Vista Event Viewer used to log all logon and logoff events, and I
> could audit all user account activities. But recently it just logs the logon
> event for user accounts and doesn't show any logoff event. I know how to turn
> on and off the auditing feature in Windows XP. But I can't find same thing in
> Windows Vista. I will appreciate if someone helps me.
My System SpecsSystem Spec
Old 04-17-2008   #3 (permalink)
arash


 
 

RE: Windows Vista Event Viewer

William,

there is no filter applied on the security log, I checked it as you said.


"William Anderson" wrote:
Quote:

> Hey there Arash,
>
> This might sound dumb, but try right clicking on the security log and see if
> you have the option to clear the filter. Do that and then check for 4634
> events.
>
> Let me know if it works.
>
> Best Regards,
>
> Will
>
> "arash" wrote:
>
Quote:

> > My Windows Vista Event Viewer used to log all logon and logoff events, and I
> > could audit all user account activities. But recently it just logs the logon
> > event for user accounts and doesn't show any logoff event. I know how to turn
> > on and off the auditing feature in Windows XP. But I can't find same thing in
> > Windows Vista. I will appreciate if someone helps me.
My System SpecsSystem Spec
Old 04-18-2008   #4 (permalink)
William Anderson


 
 

RE: Windows Vista Event Viewer

Just out of curiousity arash...what's the specific eventID you're looking for?

"arash" wrote:
Quote:

> William,
>
> there is no filter applied on the security log, I checked it as you said.
>
>
> "William Anderson" wrote:
>
Quote:

> > Hey there Arash,
> >
> > This might sound dumb, but try right clicking on the security log and see if
> > you have the option to clear the filter. Do that and then check for 4634
> > events.
> >
> > Let me know if it works.
> >
> > Best Regards,
> >
> > Will
> >
> > "arash" wrote:
> >
Quote:

> > > My Windows Vista Event Viewer used to log all logon and logoff events, and I
> > > could audit all user account activities. But recently it just logs the logon
> > > event for user accounts and doesn't show any logoff event. I know how to turn
> > > on and off the auditing feature in Windows XP. But I can't find same thing in
> > > Windows Vista. I will appreciate if someone helps me.
My System SpecsSystem Spec
Old 04-18-2008   #5 (permalink)
arash


 
 

RE: Windows Vista Event Viewer

The eventID: 4647
anytime you logoff, restart, shutdown or stanby your system, it shows the
time of logoff

"William Anderson" wrote:
Quote:

> Just out of curiousity arash...what's the specific eventID you're looking for?
>
> "arash" wrote:
>
Quote:

> > William,
> >
> > there is no filter applied on the security log, I checked it as you said.
> >
> >
> > "William Anderson" wrote:
> >
Quote:

> > > Hey there Arash,
> > >
> > > This might sound dumb, but try right clicking on the security log and see if
> > > you have the option to clear the filter. Do that and then check for 4634
> > > events.
> > >
> > > Let me know if it works.
> > >
> > > Best Regards,
> > >
> > > Will
> > >
> > > "arash" wrote:
> > >
> > > > My Windows Vista Event Viewer used to log all logon and logoff events, and I
> > > > could audit all user account activities. But recently it just logs the logon
> > > > event for user accounts and doesn't show any logoff event. I know how to turn
> > > > on and off the auditing feature in Windows XP. But I can't find same thing in
> > > > Windows Vista. I will appreciate if someone helps me.
My System SpecsSystem Spec
Old 04-18-2008   #6 (permalink)
William Anderson


 
 

RE: Windows Vista Event Viewer

Hey there Arash,

Here's a couple of articles that you may find interesting:

http://www.ultimatewindowssecurity.c...entID4634.ashx

"Microsoft's comments:
This event does not necessarily indicate the time that a user has stopped
using a system. For example, if the computer is shut down or loses network
connectivity it may not record a logoff event at all. "

However, event 4647 may be more accurate for you to find, this event is
actually logged during interactive sessions, whereas the 4634 event can be
logged for non-interactive network sessions (Just tested it on my machine):
http://www.ultimatewindowssecurity.c...entID4647.ashx

Let me know if this helps!

Best Regards,

Will

"William Anderson" wrote:
Quote:

> Just out of curiousity arash...what's the specific eventID you're looking for?
>
> "arash" wrote:
>
Quote:

> > William,
> >
> > there is no filter applied on the security log, I checked it as you said.
> >
> >
> > "William Anderson" wrote:
> >
Quote:

> > > Hey there Arash,
> > >
> > > This might sound dumb, but try right clicking on the security log and see if
> > > you have the option to clear the filter. Do that and then check for 4634
> > > events.
> > >
> > > Let me know if it works.
> > >
> > > Best Regards,
> > >
> > > Will
> > >
> > > "arash" wrote:
> > >
> > > > My Windows Vista Event Viewer used to log all logon and logoff events, and I
> > > > could audit all user account activities. But recently it just logs the logon
> > > > event for user accounts and doesn't show any logoff event. I know how to turn
> > > > on and off the auditing feature in Windows XP. But I can't find same thing in
> > > > Windows Vista. I will appreciate if someone helps me.
My System SpecsSystem Spec
Reply

Thread Tools


Similar Threads
Thread Forum
windows event viewer service. Vista performance & maintenance
HELP need to solve this problem asap - Unable to start event viewer/event log service Software
Event Viewer and Performance monitor in Windows RE Vista performance & maintenance
Windows Vista Event Viewer Problem Vista performance & maintenance
windows firewall/notifications in event viewer. Vista General


Vista Forums is an independent web site and has not been authorized,
sponsored, or otherwise approved by Microsoft Corporation.
"Windows Vista", the Start Orb, and related materials are trademarks of Microsoft Corp.
© Designer Media Ltd

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46