There comes a day when you need to find out who logged on to a server or PC. Fortunately Windows tracks log-ons and log-offs but the log may contain hundreds or thousands of entries you do not want. So the question is how to filter the log to just a specific person.
- Launch the Event Viewer
- Expand WINDOWS LOGS
- Expand SECURITY
- Click FILTER CURRENT LOG (in the right side, ACTION pane)
- Click the XML tab
- Paste in the query
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">* [EventData[Data[@Name='subjectUsername']='USERNAME']]</Select>
</Query>
</QueryList>
You need to change the ‘USERNAME’ to the user name you want to search for and then click the OK button.
1 Comment
SOLVED: Different Logon Types Explained – Up & Running Technologies, Tech How To's · December 5, 2022 at 3:24 pm
[…] the Windows Event Viewer you will frequently see events 4624 and 4625 in the Security Log but the entry will only give you a number and one word description, which is not […]