How to view last logon computer time and information

1, skillfully use the strategy, record last logon time

In the case of multiple people using the same computer, we often encounter the phenomenon that when we leave the computer temporarily, there are other users secretly use their account to log on to the system, to view their records of operations and other access traces. To find out who is secretly concerned about the privacy of their operations, we can use the Windows Vista System Group Policy settings to automatically track the time to display the last login system, and we can also see which account is secretly logged into the local computer system, The following is the specific implementation step of the method:

First, open the Windows Vista System "Start" menu, select the "Run" command, in the pop-up System Run dialog box, enter the "gpedit.msc" string command, click the "OK" button, enter the corresponding system of the Group Policy console window;

Second, select the Computer Configuration node option in the left pane of the Console window. Then select the Administrative Templates/Windows Components/Windows logon options project from the node below and locate the target Group Policy from the right display pane of the Windows logon options project "Display information about previous logons during user logon", and then double-click the Target Group Policy option to open the Options Settings dialog box.

Check that the started option in this dialog box is selected. If you find that it has not been selected, we just have to select it again, and then click OK to save the setup action, so that the local Windows Vista system has the ability to automatically record the last logon system time.

After completing the above setup operation, if an illegal attacker uses our account to log on to the computer while we are out of the computer, Windows Vista will automatically save the time and memory of the illegal attacker's login system, and the next time we turn on the computer to enter the password for the login system, The system screen will be the last time to log on the system, and we can also see the specific user account to perform the login operation, at this time we can based on these status information to find specific illegal attackers, to ensure that the computer system will not continue to attack the future.

2, skillfully use the script, record this time of login

Sometimes, we hope that the Windows system can automatically remember the time of the user's login system, and then compare their actual login time, if there is a significant difference between them, it means that the time to leave the computer, it must have been secretly visited the local computer system. To record this logon time, we can create a system startup script, let it automatically display, save the system login time, and then find a way to let Windows system after the launch of the successful automatic execution of the startup script can be, the following is the specific implementation steps:

Start by opening a text editor such as Notepad, where you enter the following command-line code:

@echo off

date/t >> D:time.log

time/t >> D:time.log

After confirming that the command line code entered is correct, click the file/Save command in the text editing window, and then save the command code as a batch file with the extension bat, assuming that we name the file "Time.bat" here, and double-click the batch file with the mouse. The current time of the system will be saved to the "D:time.log" file;

Second, to allow the system to automatically execute the "Time.bat" file when the login is successful, we need to set the file as the system startup script. In this setup operation, we can click the local System "start"/"Run" command, in the pop-up System Run dialog box, the input string command "Gpedit.msc", click Enter, open the corresponding system's Group Policy console window;

In the left display area of the console window, use the mouse to select the Computer Configuration/Windows Settings/script (start/Shutdown) node option, and in the right display area for the script (start/Shutdown) node option, double-click the startup item to open the Property Settings window.

Click the Add button in the Settings window, and from the file selection dialog that appears, select the Time.bat file and click OK to import it into the Startup script list box, and then click OK to save the settings. As a result, every time the Windows system starts successfully, the "Time.bat" batch file is automatically executed, and the file can be saved to the "D:time.log" file exactly the moment when the system was successfully started, and then we just look at "D: Time.log "file, you can see this login system specific time.

3, skillfully use the log, record each time log in

Windows system has a powerful logging capability, and is good at using this feature, we can let it automatically remember the time of each login system, even if the illegal attacker logged on to the local system failed, Windows system log can also record it. When using the log function to record each logon system time, we need to follow the following steps:

The first step is to audit the system logon events. By default, the Windows system does not log save on system logon events, and only if the event is audited, its log function automatically tracks, remembers system logon events, and when auditing system logon events, we can click the start/Run command in turn. In the pop-up System Run dialog box, execute the string command "Secpol.msc" to open the corresponding system's local Security policy window;

Second, expand the security Settings/Local Policy/Audit Policy Branch options in the left position of the window. From the target branch, double-click the Audit logon events option, open the Settings dialog box, select the Success, Failure option, and then click OK to save the setup action; After the above set up operation, the Windows system will be able to automatically record the time of each login system in the future;

If you want to see how long each time you log on to the system, we can directly right-click on the corresponding system desktop, "Computer" icon, from the right-click menu to select "Management" command, open the corresponding System Computer Management window, in the left position of the window, select the System Tools/Event Viewer/ Windows Log/System branch options, under the target branch option we can see the specific records of each login system, double-click the logging option to see the specific login time.