Occasionally I find it necessary to try to figure out when I arrived at work, left work, went to break and so on. It has happened that the end of the week came along and I had forgotten to fill in a day or two and don’t remember precisely what times to put in. The problem is that if you can’t remember exactly when these times are, you have to err on the side of caution and cut yourself short on time that you actually worked. It’s also important to be accurrate on records such as these.
This lead me to think about ways that I could track this in case I forgot as well as more accurrately so that I’m not shorting myself or my employer. After thinking about it I realized that the first thing I do in the morning is logon to my computer and the last thing I do is lock it. When I go to break, I lock it and log back in when I get back. I also know that Windows is meticulous about its “record keeping” and logs events for every little thing that takes place in one of its event logs.
I then performed logons, logoffs, workstation locks, etc. and searched the Security event logs for these events. I came up with the following events related to logon-logoff events.
Setup New Event View
Now, in order to setup the “time clock”, follow these steps for Windows 7.
- Open Computer Management.
- Click on Run under the start menu.
- Type compmgmt.msc in the textbox and click OK.
- Select Manage from menu that pops up.
- Navigate to System Tools -> Event Viewer -> Windows Logs ->Security item in the left pane.
- Right-click the Security event log and select Create Custom View.
- Fill in the filter fields as follows and click OK.
- Logged: Any time
- Event level: None Selected
- By log: Selected
- Event logs: Windows Logs (not selected) -> Security (selected)
- Event IDs: 4647,4648,4800,4801
- Keywords: Audit Success
- Add the name of the new view to the Name field.
- Add a description of the new view to the description field (optional).
- Select the location to store the new view under in the tree view.
- You can select an existing folder.
- You can also use the New Folder button to create the folder structure you want.
- Make a choice using the All Users checkbox.
- Check: If you want the view accessible by all users.
- Uncheck: If you want the new view accessible only by you.
- Click OK.
Now that you’ve created the new view, you can access it by navigating to System Tools -> Event Viewer -> Custom Views -> CUSTOM VIEW NAME, where CUSTOM VIEW NAME is the name of the view you entered in step 6 above.
Please note that the logon and logoff events are sometimes duplicated and have event IDs like 4624. I haven’t had time yet to determine if one event ID is better to track the logon and logoff events than the others. If you do and want to let me know, please feel free to comment on this post and I’ll update it. What I would ultimately like to have is a single event either Logon, Logoff, Lock Workstation, Unlock Workstation or Shutdown. This way it would read just like a time card.