Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Determine if someone tried to login to windows


  • Please log in to reply

#1
codecraig

codecraig

    Member

  • Member
  • PipPip
  • 61 posts
Using Win XP Pro is there a way to determine if someone tried to login to windows? For example if the PC is running and is at the login screen...and someone attempts to login but fails (or even succeeds)..is there a way to find out?

thanks
  • 0

Advertisements


#2
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
I think the Windows Event Viewer is what you are looking for :tazz:
  • 0

#3
codecraig

codecraig

    Member

  • Topic Starter
  • Member
  • PipPip
  • 61 posts
perhaps...but I don't see an easy way of finding login information, do you know where to find it?
  • 0

#4
codecraig

codecraig

    Member

  • Topic Starter
  • Member
  • PipPip
  • 61 posts
nevermind, I found what I needed:

Keeping a record of windows user login attempts

....if you visit that look and look at the fourth post you'll see instructions on how to enable logon/logoff auditing for win xp and win 2000.

then once you enable it, you can go to the Event Viewer / Security Events and see if someone tried to logon.
  • 0

#5
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
I think it was something like that in the Microsoft site also:

Under Event Log Types:

Security log

The security log records events such as valid and invalid logon attempts, as well as events related to resource use, such as the creating, opening, or deleting of files. For example, when logon auditing is enabled, an event is recorded in the security log each time a user attempts to log on to the computer. You must be logged on as Administrator or as a member of the Administrators group in order to turn on, use, and specify which events are recorded in the security log.


But your link is better :tazz:

Glad you found it and resolved your problem.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP