Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 8.1 last logon info?


  • Please log in to reply
11 replies to this topic

#1 questdimdim

questdimdim

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:07:57 PM

Posted 04 August 2016 - 01:40 PM

Guys i activated my DisplayLastLogonInfo in my windows 8.1 laptop to see the information about my last login everytime i log in. I wonder is the information sure. I mean is it possible my roomate to login and then delete his login is some registry so when i log again later i only see my last login not his. I ask because i am afraid he catches my password via keylogger or something and i want to be sure that he isnt loggin while i am gone. Thanks in advance..



BC AdBot (Login to Remove)

 


#2 Chris Cosgrove

Chris Cosgrove

  • Moderator
  • 6,226 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Scotland
  • Local time:05:57 PM

Posted 04 August 2016 - 06:11 PM

First of all - welcome to BC !

 

I think you are being a touch over-paranoid here, but if he is doing this and using your credentials then the only change would be the time of the log-on, there would be no need to play with the registry. The best thing you could do is practice changing your password frequently, and use non-intuitive passwords. You could also employ the old espionage tricks of putting a thread or a hair in the hinge so that it falls out if the lid is opened.

 

It is a fact of life that if someone has direct access to your computer, ie sitting down in front of it, then they can essentially own it. If you have serious grounds to believe this is happening then your best approach might be to ask for a change of room mate.

 

Chris Cosgrove



#3 questdimdim

questdimdim
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:07:57 PM

Posted 04 August 2016 - 11:25 PM

Thank you for the really quick answer. Yes i've tried the good old putting something on the top and i am probably just paranoid, but my roomate is just the type of guy from the movies you dont want to be roomate with. I know for sure that he somehow cracked his old girlfriend's facebook password, making her huge problems, they even had the police called but they ofcurse said they can do nothing. He is kind of advanced with software managment, i myself only know the basics. Other friends from collage warned me to be carefull with this guy. I did not know those stories before so i gave him acsess to my laptop few times in the past, although i was usually watching what he is doing. I always had password, i fear if he could have installed some keylogger so he could track my password. I am definetly moving out but i can only do that september or octobmer, i've already repaid my loan and i dont have cash right now. So if i understand you correctly, he can log into my laptop, do what he wants to do and set up the things so next time i log i will not see his logon but only my last login and there is no possible way for me to be sure if someone logs. This is really hell. Thank you again and sorry for my bad english :)



#4 questdimdim

questdimdim
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:07:57 PM

Posted 05 August 2016 - 05:25 AM

Mod Edit:  Removed comment to spammer whose post has been removed - Hamluis.

 

I've made my question way too long guys, all i am asking is when i activate this DisplayLastLogonInfo into the Registry Editor of my Windows 8.1, and from there on everytime i log in it shows me infromation about my last log and any failed attempts, so is this information 100% sure or someone can still manage to corrupt it and log without being noticed? I know that he can disable the option and stuff, but then i will know that someone has played with my machine and i will contact the apartament owner and even the police if i have too, i just need to be sure if my roommate ever tried anything (although i am sure its just paranoia, we live in different rooms in the apartament, the rooms can be locked but only from inside, so when i am gone out he could still enter although it would be kinda illigaly, and we dont cross our roads that much) I've read a few articles and all of them say that this is the surest way to be sure and the information cannot be deleted. Thanks again for all the answers :)


Edited by hamluis, 03 February 2017 - 12:21 PM.


#5 Chris Cosgrove

Chris Cosgrove

  • Moderator
  • 6,226 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Scotland
  • Local time:05:57 PM

Posted 05 August 2016 - 04:45 PM

The point I was trying to make is that if he has cracked your computer access code and is using your log-ins, your log-in record will show just another log-in by you with the only difference being the time stamp. You would need to note the time you logged out and then compare that with the last log-in the next time you sat down at the computer.

 

You didn't say if this is a laptop or not, but if it is could you take it with you ?  Removing temptation or 'an occasion of sin' as it was called in my childhood.

 

Chris Cosgrove



#6 FreeBooter

FreeBooter

  • Members
  • 3,137 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Turkey - Adana
  • Local time:07:57 PM

Posted 05 August 2016 - 06:29 PM

You  want to protect your personal files and passwords then you make sure any person you don't trust login to your laptop with Windows Guest account.

Guests Accounts are usually created when we want someone to have a temporary access to your personal computer system. A guest account is a temporary account and the user is strictly not allowed to perform any changes to your PC settings or to access any of your personal files stored in the PC. Unlike the Standard User or Administrator, Guest account users cannot create a password, install a software on your PC or can’t even modify any of your PC settings. All a guest account user can do is to log on your PC, browse and surf on the web and can shut down the PC.

You should also encrypt your personal files or encrypt all hard disk drive to stop any one to have access to your laptop hard disk drive.

 

Enable or disable the built-in Guest account via Command Prompt.

 

 

Open an elevated Command Prompt window (press Win + X, and then press A key)

 

 

Run below command from Command Prompt that is open as administrator.

net user guest /active:yes

Above command enables Windows build in guest user account.

 

Type below command to disable Guest user account.

net user guest /active:no


Share your knowledge. Its a way to achieve immortality.
- Dalai Lama

 

 


#7 questdimdim

questdimdim
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:07:57 PM

Posted 05 August 2016 - 07:40 PM

Thank you again for the responces :) Chris, yea i was talking exactly for the time login, sorry for not mentioning that. I only log in from one local user account (admin account), so i monitor the timelapse while i was gone to check if someone logged the timeperiod i was gone. By far there are no logins or login attemps made while i am gone, so i was wondering if he logs in,if he can mess up the time, the clock system or however, somehow never to show me the time he logged to my account, i am sure you got my point. About going around with my laptop (its dell inspiron by the way) i am not sure if it's possible all the time, exept for the longer trips. Again we live in separate rooms and he is not allowed to come to my room, so if i catch some suspicious time activity i will know for sure somethings wrong. I am sure its just paranoia,we are not like fighting or something, we just dont talk that much but live in same apartment, the guy has his own trouble and i mine, just this stories i heard about similar things he did makes me nervous, since we share some friends and stuff.

 

FreeBooter thank you too, but i dont want this guy to have any accsess, i've given him before to check his emails and stuff through my only account (local admin account), but mostly i was checking out what he is doing and i trusted him before. So i just want to be sure that windows shows me the right time i've last logged so i could be sure.



#8 FreeBooter

FreeBooter

  • Members
  • 3,137 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Turkey - Adana
  • Local time:07:57 PM

Posted 05 August 2016 - 09:25 PM

Event ID 4624 This event is generated when a logon session is created. It is generated on the computer that was accessed.

 

 

2016-08-06%2005_07_22-Computer%20Managem
 

The Event ID 4647 shows Logoff time. This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
 

You can open Event Viewer by pressing 7W6b39o.png  keys  and type eventvwr.msc into Run dialog box.

 

 

If you like before shutting down your computer run the batch script below to clear all log files so next time you login there won be so much log to go through.

 

Attached File  Clear_Temp.bat   5.94KB   15 downloads

Edited by FreeBooter, 05 August 2016 - 09:28 PM.


Share your knowledge. Its a way to achieve immortality.
- Dalai Lama

 

 


#9 questdimdim

questdimdim
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:07:57 PM

Posted 05 August 2016 - 10:01 PM

FreeBooter very strong point.I knew about this event and i was checking them at first, but i read that they can be deleted and than i activated the displaylogons. However i was always thinking even if he deletes everything, his log off will still remain regardless what he does, but now when you said that i will clear all logs before log off than when i log in again i will check when the last logoff happened. I belive with that extra layer of checking, with the logon info displayed at the start, and with little old tricks like something super small on top of the laptop when i close it as Chris suggested  should be enough. I still will take the laptop with me if i am leving for longer periods, just in case :)



#10 FreeBooter

FreeBooter

  • Members
  • 3,137 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Turkey - Adana
  • Local time:07:57 PM

Posted 05 August 2016 - 10:17 PM

When logs been deleted there will be log entries for when the logs are deleted date and time included.

 

 

2016-08-06%2006_15_12-Computer%20Managem


Edited by FreeBooter, 05 August 2016 - 10:19 PM.


Share your knowledge. Its a way to achieve immortality.
- Dalai Lama

 

 


#11 questdimdim

questdimdim
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:07:57 PM

Posted 05 August 2016 - 10:27 PM

Good, good information, I'll clear everything before leaving and when i log in again i'll check the time of the last event if it match the time i've left. Thanks i'll use it 



#12 FreeBooter

FreeBooter

  • Members
  • 3,137 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Turkey - Adana
  • Local time:07:57 PM

Posted 08 August 2016 - 01:27 PM

You are very welcome!



Share your knowledge. Its a way to achieve immortality.
- Dalai Lama

 

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users