WinLogOnView is a tiny portable tool which uses the Security event log to detect and list the date and time that any user has logged on to/ logged off from your PC.

The program displays this information as a table containing the following information: Logon ID, User Name, Domain, Computer, Logon Time, Logoff Time, Duration, and network address.

This worked reasonably well for us. If you're the only person using your PC - or your account isn't password-protected - then at a minimum you should see all your system logons for quite some time (a month or more). If there are other accounts, you'll be able to see when they're being accessed. And as ever with NirSoft tools, right-clicking any item gives you options to save the data as a report for easy reference later.

There's also an option to display this same information for other computers on your network, as long as you've the security rights to do so (Options > Advanced Options). Surprisingly, WinLogOnView can even access the logons for an offline system: just point the program at its event log location. (Make an image of the drive, say, then get that image to the WinLogOnView computer.)

All this works by using regular Windows events, with no need to set up any special monitoring component, so you can run it and get results right away.

But at the same time, the event logs won't always contain all the necessary information. One of our test systems displayed logon times, but no logoffs, so we were never able to see session durations.

Version 1.33:

The loading process is now faster when using the 'Use New Event Log API' option.