Computer activity

[Eneswar]

Hey guys, this sounds like a stupid question but is there a way to see if the computer has been started, what time and so on without installing a third party program?

I would just need to know what time the computer was started and what time it got shut down, I dont need to know what has been done etc on the computer.


Thanks in advance

 

[TimStitt]

Hi Eneswar,

The event viewer should show that.... I'll take a look and see if I can come back with what number events we need. Stay tuned.

 

[Bill2]

Open up Event Viewer, head into the Windows Logs -> System log, and then filter by Event ID 6005 to see when the system was last turned on—that event shows when the event log service was started again.

 

[TimStitt]

Ok, well it's not as easy as I thought. I had a quick look at my event viewer to see when the LOGICAL DISK MANAGER service entered the running state. Aas I'm sure that this is the firs service started and so would show me the start times of my PC. It's event 7036, but I had to look through a few of them and compare that to the times and dates. This works but is time consuming, so I will hunt for something easier.

By the way the command systeminfo will show you the up-time.

You could try enabling boot logging (this is for the future only) and see if the time is recorded.

I'll think some more on this.... I feel that the obvious is just escaping me.

 

[TimStitt]

Open up Event Viewer, head into the Windows Logs -> System log, and then filter by Event ID 6005 to see when the system was last turned on—that event shows when the event log service was started again.

The question I suppose is how accurate the times need to be. If a minute or so either side is ok then this event is a great one to look at.

 

[dnorris]

Open Task Manager, click on the Performance tab
it lists the Up Time...
looks like it's DD:HH:MM:SS

 

[Eneswar]

Thanks all for the replies. I dont want to know the up time Just that if the computer was turned on i wanted to see what time this was, and i think i figured it out thanks to TimStitt and Bill2, went to the event viewer > windows logs > system log and there i can see

Thank you both!

 

[WindowsStar]

This will give you what you need (in an elevated command prompt type):

systeminfo | find /i "system boot time"

 

[TimStitt]

This will give you what you need (in an elevated command prompt type):

systeminfo | find /i "system boot time"

Yeah I mentioned systeminfo above, as I also misunderstood; but it only shows the information from the current boot. Not when the PC was last booted before the currently booted time.

E.g.
User boots up during the day and turns off when finished. You come in and boot up and want to see the times of the previous users session (without using any 3rd party apps).

 

[WindowsStar]

This will give you what you need (in an elevated command prompt type):

systeminfo | find /i "system boot time"

Yeah I mentioned systeminfo above, as I also misunderstood; but it only shows the information from the current boot. Not when the PC was last booted before the currently booted time.

E.g.
User boots up during the day and turns off when finished. You come in and boot up and want to see the times of the previous users session (without using any 3rd party apps).

Well that makes two of us. UGH!

 

[WindowsStar]

Ok here you go: This is not a 3rd party solution. Use PSLogList from Microsoft.

PsLogList

Then use: psloglist -i 6009

That should show everytime the computer booted.

 

[Eneswar]

Hmm I thought the event viewer > windows logs > system log showed that? Or am i completly wrong?

 

[TimStitt]

@Eneswar
Hey you're perfectly correct, the event logs show exactly the information that PsLogList does.

However, Windowstar has demonstrated another appraoch that potentially makes it easier for us to filter the log and write it into a batch program. Thus making it a one click process. It really depends on your needs and if the information is required as a one-off or will be a reoccuring process.

@Windowstar
+1 for added information and offering other members/visitors in the future another solution that may work for them.

 

[Eneswar]

Ah I see now I will stick with the system log one for now but aye thank you for the PsLogList. Will try it if I need it later on