Windows Logon Time logs

[ric-o]

You wont see any logon or offs in the Security log unless you turn on auditing for those events. They are off by default - at least on XP Pro.

To turn auditing of logons and logoffs...
1) Pull down the menus START, SETTINGS, CONTROL PANEL, ADMINISTRATIVE TOOLS
2) Select LOCAL SECURITY POLICY
3) Under LOCAL POLICIES section click AUDIT POLICY
4) Double-click AUDIT ACCOUNT LOGON EVENTS
5) Check SUCCESS and FAILURE
6) Click OK to save the settings
7) Do this for AUDIT LOGON EVENTS item as well

The one thing to keep in mind if the user doesn't log out you wont have that event.

Good luck

[;TT]

Security events such as logons/logoffs are recorded by default.

Security log
The security log records events such as valid and invalid logon attempts, as well as events related to resource use, such as creating, opening, or deleting files or other objects.

[oofki]

In home I believe they are because the computer I looked at they were enabled.

[ric-o]

Originally posted here by ;TT
Security events such as logons/logoffs are recorded by default.

Hey I'll freely admit when I'm wrong but I'm right on this ...at least this is how a default build of Window XP Pro I literally JUST installed 2 days ago shows: auditing of logon events and such are OFF. Take a look at the JPG I took of the local audit security policy: how can you explain this?

This coupled with the fact that I see NO events in the Security Log after logging off and into the box...that would say auditing is off.

So not sure which version you are looking at ;TT ...I'm puzzled???

[;TT]

No clue ric-o, absolutely no clue. On all installs I've done, all security events are logged by default and I never touch the settings. Are you using an OEM install or ?

[nihil]

I'm with ric-o on this one...............I just checked this XP pro box, and it is all switched off. I guess that makes sense, as the OS is mainly intended as client software in a networked corporate environment, so the admins would set whatever policies they wanted, rather than relying on defaults.

I think SDK has a good point, some sort of total hours or curfew program is what you need. If the kid doesn't log-off, then there will be no event to record?