![]() |
![]() | ![]() | ![]() | ![]() | ![]() | ![]() | ![]() |
|
Welcome to Vista Forums we are your forum to discuss Windows Vista x64 and x86 systems. Whether you need help or just want to post an idea you have on Vista, this is the forum for you.
br> br> |
| |||||||
![]() |
| | Thread Tools | Display Modes |
| | #1 (permalink) |
| Guest | Windows Vista Event Viewer My Windows Vista Event Viewer used to log all logon and logoff events, and I could audit all user account activities. But recently it just logs the logon event for user accounts and doesn't show any logoff event. I know how to turn on and off the auditing feature in Windows XP. But I can't find same thing in Windows Vista. I will appreciate if someone helps me. |
| | #2 (permalink) | ||||||||||||
| Guest | RE: Windows Vista Event Viewer Hey there Arash, This might sound dumb, but try right clicking on the security log and see if you have the option to clear the filter. Do that and then check for 4634 events. Let me know if it works. Best Regards, Will "arash" wrote:
| ||||||||||||
| | #3 (permalink) | ||||||||||||||||||||||||
| Guest | RE: Windows Vista Event Viewer William, there is no filter applied on the security log, I checked it as you said. "William Anderson" wrote:
| ||||||||||||||||||||||||
| | #4 (permalink) | ||||||||||||||||||||||||||||||||||||
| Guest | RE: Windows Vista Event Viewer Just out of curiousity arash...what's the specific eventID you're looking for? "arash" wrote:
| ||||||||||||||||||||||||||||||||||||
| | #5 (permalink) | ||||||||||||||||||||||||||||||||||||
| Guest | RE: Windows Vista Event Viewer The eventID: 4647 anytime you logoff, restart, shutdown or stanby your system, it shows the time of logoff "William Anderson" wrote:
| ||||||||||||||||||||||||||||||||||||
| | #6 (permalink) | ||||||||||||||||||||||||||||||||||||
| Guest | RE: Windows Vista Event Viewer Hey there Arash, Here's a couple of articles that you may find interesting: http://www.ultimatewindowssecurity.c...entID4634.ashx "Microsoft's comments: This event does not necessarily indicate the time that a user has stopped using a system. For example, if the computer is shut down or loses network connectivity it may not record a logoff event at all. " However, event 4647 may be more accurate for you to find, this event is actually logged during interactive sessions, whereas the 4634 event can be logged for non-interactive network sessions (Just tested it on my machine): http://www.ultimatewindowssecurity.c...entID4647.ashx Let me know if this helps! Best Regards, Will "William Anderson" wrote:
| ||||||||||||||||||||||||||||||||||||
| |
| |
![]() |
| Thread Tools | |
| Display Modes | |
| |
Similar Threads | ||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Event Viewer and Performance monitor in Windows RE | Amgeek | Vista performance & maintenance | 0 | 3 Weeks Ago 11:33 AM |
| Windows Vista Event Viewer Problem | arash | Vista performance & maintenance | 3 | 04-15-2008 08:50 PM |
| windows firewall/notifications in event viewer. | peter c.a.hawkins | Vista General | 1 | 02-07-2008 06:12 PM |
| services and event viewer in vista | glectic | Vista General | 1 | 01-15-2008 04:10 PM |
| Vista Event Viewer | vegaspat | Vista account administration | 2 | 10-24-2007 12:32 PM |