Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

LoginUI.exe file-help


  • Please log in to reply
3 replies to this topic

#1 jytheory

jytheory

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:22 PM

Posted 07 March 2014 - 02:22 PM

I'm an accountant by trade and am trying to understand what the term LogonUI.exe file is in general terms. Also, if an employee has that file does that mean he was logged in at his computer? For instance, the employee has a LogonUI.exe file with the time of 7:56 a.m. However, our records indicate he got in at 8:32 a.m. His claim is this file proves he was in earlier than 8:32 by using this file as proof. Can anyone help? Thanks.

 



BC AdBot (Login to Remove)

 


#2 dls62

dls62

  • Members
  • 623 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Berkshire, UK
  • Local time:04:22 AM

Posted 07 March 2014 - 02:41 PM

In a Windows NT based system, LogonUI.exe implements the graphical user interface shown when a user is asked to log in to the local machine. This is a core component of Windows and should be left alone.  It should be located in the Windows\System32 folder.  If it is anywhere else there is a high probability that it is malware.  The genuine file is not modified when a user logs in to a computer.



#3 jytheory

jytheory
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:22 PM

Posted 07 March 2014 - 02:44 PM

Thanks. But by having that file on his hard drive does it back up the claim that the employee was logged on his computer at 0756 as he claims? Thank you for the swift response.



#4 dls62

dls62

  • Members
  • 623 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Berkshire, UK
  • Local time:04:22 AM

Posted 07 March 2014 - 02:51 PM

It will appear on every Windows NT based computer, e.g. XP, Vista, Windows 7.  The file modified date and time do not get updated when a user logs on to the computer so cannot be used as evidence of such.  By example on my Windows 7 x64 system the file modified date and time is 21/11/2010 03:24.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users