Tom's Guide | Tom's Hardware | Tom's Games
![]() |
![]() |
![]() |
How do I check for login time history. I am doubting that someone is logging on to my system when I am not around.
Thank you in advance!
Mathy

One trick is to look at the RB0## files in C:\Windows\SysBCKUP (hidden) folder, and look at the date/time information. The first time a system is booted each day, the ScanReg program in Startup makes a backup of the system registry files here. So if you see a file with a date/time and you did not boot the system yourself that early in the day, then you know someone else did before you.
An even better method, assuming you have the default Task Scheduler in your MSCONFIG Startup list, to to check the Task Scheduler LOG. Go to Start, Programs, Accessories, System Tools, Scheduled Task utility. Click the "Advanced" button, and on the list click the "View Log" entry. This will bring up a Notepad window with the Task Scheduler LOG. In it will be the recent date/time entries for all the Scheduled Tasks that have been started and ended. More important there will be an entry in the log that reads "Task Scheduler Service" / Started at mm/dd/yyyy h:mm:ss. These entries represent each time the system was booted.
This log is a fixed length file that wraps strange, so the last entry is not at the bottom, but is clearly marked, then work back-wards.

![]() |
![]() |
![]() |

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |