Using event viewer to see who has logged into a specific computer

[talksr]

Hi there,

 

I would like to use Event Viewer on our server to see exactly who has logged into our server for a specific time period.

 

Does anyone know how I should set up the advanced search feature within Event Viewer such that I can see what I am after in the logs?

[dapaulio]

Not sure if it is overkill but you could write a powershell script that writes to the event log to run on logon.

This may help

https://blogs.technet.microsoft.com/heyscriptingguy/2013/06/20/how-to-use-powershell-to-write-to-event-logs/

Alternative look at the security log there are events within there that will list user tagged events

Edited September 6, 2016 by dapaulio

[talksr]

Not sure if it is overkill but you could write a powershell script that writes to the event log to run on logon.

This may help

https://blogs.technet.microsoft.com/heyscriptingguy/2013/06/20/how-to-use-powershell-to-write-to-event-logs/

Alternative look at the security log there are events within there that will list user tagged events

 

Thanks, your first suggestion would only work from now on wouldn't it? I am looking for something which would work for past events in the log.

 

The second suggestion, I have tried, but when I filter, it just keeps saying it can't find anything.