How do I find if someone is using my computer in my absense?

You can check if someone has been using your computer in your absense by looking at the event logs in Event Viewer on a computer running Windows XP.

To run Event Viewer click Start, click Run, type eventvwr.msc in the Open box and click OK.

Events are stored in three log files: Application, Security, and System. These logs can be reviewed and archived.

For our purpose we want the System log. Click on "System" in the left-side frame for a list of events. Look for a date and time when you weren't home and your computer should have been off. If you find an entry with a date and time when you were away, your computer has definitely been used by someone other than you. For detailed information on any event, double click the event in the right pane.

You can also use this log to see how long someone was on the computer. Just look at the time the computer was turned on and off for that day.

The security log records events such as valid and invalid logon attempts, as well as events related to resource use such as creating, opening, or deleting files or other objects. An administrator can specify what events are recorded in the security log. For example, if you have enabled logon auditing, attempts to log on to the system are recorded in the security log. Only administrators can gain access to security logs. By default, security logging is turned off. You can use Group Policy to enable security logging. The administrator can also set auditing policies in the registry that cause the system to halt when the security log is full.

Print this post

Related Posts by Categories

Widget by Scrapur | Scrap Book