Windows 10 Logging - Page 1
Forum section: electronics / general

author: bostonman
author_rank: Super Contributor
timestamp: June 09, 2020, 01:05:44 pm
content: I have a question, I know Windows 10 (and probably all versions of Windows) logs things like login, shutdown, etc...Assuming no additional software is installed, and the computer isn't on a network, does it track other stuff from a user such as which programs were being used, how much activity was being performed, etc...?

author: Jeroen3
author_rank: Super Contributor
timestamp: June 09, 2020, 02:31:57 pm
content: Yes, there is performance and diagnosis analysis.

author: bostonman
author_rank: Super Contributor
timestamp: June 09, 2020, 03:15:34 pm
content: So I could go back a week and see how active a computer was at some point?I'm trying to see if someone used a computer while I wasn't home over the course of days. I don't see any new files, but trying to see if someone edited say an open spreadsheet, or which programs were loaded.Obviously any new saved files would show, but if i had an Excel sheet open and someone made changes without me knowing, I returned, continued editing the sheet, saved it, would I be able to see activity during a specific time frame? Or would the log show how active a person was such as how often keystrokes were pressed or whatever?

author: Jeroen3
author_rank: Super Contributor
timestamp: June 09, 2020, 07:53:37 pm
content: Well, you'd have the "recent files" list...Those other logs are stored somewhere, but I was unable to find docs for those features. Many are also used for "improvements" by Microsoft and not public anyway.

author: bostonman
author_rank: Super Contributor
timestamp: June 10, 2020, 01:14:08 am
content: I'm also asking for curiosity.Windows login would obviously be added to the log, but what if the computer locks the screen and then is unlocked with a password, would that be in the log too or does it not concern itself with locked screen.My other question: if someone wasn't very active on the computer, but doing just enough to keep it from locking, would that show in the Windows log as inactivity or would it not care?

author: SilverSolder
author_rank: Super Contributor
timestamp: June 10, 2020, 02:28:07 am
content: Quote from: bostonman on June 09, 2020, 03:15:34 pmThat scenario would be very difficult to catch, because the file would not get a new time stamp if they did not save it. Can you compare it with an earlier backup of the file?Where I work, walking away from your computer without locking the screen is sufficient reason to get fired... some customers are very sensitive about their data!

author: bostonman
author_rank: Super Contributor
timestamp: June 10, 2020, 02:37:02 am
content: I guess I'm trying to understand a few things; some for a problem in hand and the other for general understanding.The first is whether automatic computer locking (and unlocking) is logged. From research, I believe this is true as each time the computer locks (whether manually or automatic) and then unlocked, it's logged. So someone can't just turn on a computer and let it sit idle for an hour, unlock the screen, and then let it sit idle again. Is this true?The second is: does Windows log whether a computer sat idle or was actually being used for productivity. In this case, someone could be moving the mouse periodically causing it to not lock. So does Windows keep track of what is being done on a computer (ignoring file date/time stamp)?

author: Jeroen3
author_rank: Super Contributor
timestamp: June 10, 2020, 08:06:05 am
content: All credential manager access is logged. And the log "Microsoft Office Alerts" logs all popups (eg: do you want to save foo.docx)

author: bostonman
author_rank: Super Contributor
timestamp: June 10, 2020, 12:01:43 pm
content: I'm uncertain what you're asking.I'm not looking to save anything, just curious what Windows 10 saves in the log during normal usage.

author: gbaddeley
author_rank: Regular Contributor
timestamp: July 06, 2020, 12:47:50 pm
content: Look at Event Viewer, eventvwr.exe