How long have you been at work? A Windows Hack.

I get into work anywhere between 8:00am and 9:30am. As the end of the day draws on, I’m sometimes not sure whether I’ve served my time. To make sure I don’t go home too early, I use this little trick.

Windows tracks your logons in the event log. So to find out when you came in;

  1. Open the event viewer; *windows+r, ‘eventvwr’, enter*
  2. Select ‘Custom Views’
  3. Right-click and choose ‘Create custom view…’
  4. Open the ‘XML’ tab
  5. Check ‘Edit query manually’
  6. Enter this XML;

    <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4672)] and EventData[Data[@Name='SubjectUserName'] = 'your-name-here']]</Select>
  7. Replace ‘your-name-here’ with your domain username
  8. Choose ‘OK’.
  9. Set the name to ‘Logins’
  10. Hit ‘OK’.

And there you go. There in Custom Views will be a list of your login events. Find the earliest one in the day and that’s when you first logged in.


%d bloggers like this: