How to know when the user logged in and logged out?

Question

0.00/5 (No votes)

See more:

I want to make a simple exe file with a datagrid of the info of the times the current user:

1- Logged in.
2- Logged out.
3- Restarted PC.
4- Shut down PC.
5- Turned on PC.
6- Hibernated PC.
7- Suspended (sleep) PC.

And I would list them by time, for example if the user took the meds when he turned on his PC or woke it up from sleep and needs to know when that happened to backtrack taking his meds he would open this exe file to see the times.

What I have tried:

Looking in Windows Event Viewer to the index number of these actions.

Posted 12-Dec-20 22:42pm

john1990_1

Updated 13-Dec-20 7:07am

Add a Solution

Comments

[no name] 13-Dec-20 11:20am

Yep. Keep looking at the Windows events. That's where it is. Next you write a report.

john1990_1 13-Dec-20 13:19pm

I almost did it all, check my answer and see if you can provide me with the event IDs please...

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

john1990_1 · Accepted Answer · 2020-12-13T07:07:00

With:

using System.Diagnostics;

foreach (EventLog log in EventLog.GetEventLogs())
            {
                if (log.Log == "Security")
                {
                    foreach (EventLogEntry e in log.Entries)
                    {
                        switch (e.InstanceId)
                        {
                            case 4672:
                                dataGridViewNamesAndTimes.Rows.Add("Special Logon", e.TimeGenerated);
                                break;

                            case 4625:
                                dataGridViewNamesAndTimes.Rows.Add("An account failed to log on", e.TimeGenerated);
                                break;
                        }
                    }
                    break;
                }
            }

I now only need to check the InstanceId in Windows Security Log Events[^] and check which events I want to show in the datagrid, with checkboxes to toggle show/hide of each of the event Ids...

Would someone please help me find the InstanceIds of these actions since the explanations in the link above aren't always accurate and are fuzzy?

When the user:
1- Logged in.
2- Logged out.
3- Restarted PC.
4- Shut down PC.
5- Turned on PC.
6- Hibernated PC.
7- Suspended (sleep) PC.