Can I find out when my computer turned on and who was running it?

User question

Hello.

Tell me, can I somehow find out if my computer was turned on, and if so, who did it? I just can't find certain files in any way, as if someone deleted them ...

Hello.

Finding out when the computer was turned on is quite simple (unless, of course, this data was intentionally erased). As for the person who made it, everything is quite complicated here (you are unlikely to succeed, unless, of course, you have previously configured the device's protection so that it automatically captures everyone on the webcam who sits down to work for him; or video surveillance is not installed in the room ✌).

In general, in this article I will try to sort out your question. By the way, so that this does not happen again, I recommend making backups of important files, and setting a password for accessing the PC (links below for help).

To help!

1) How to set a password on a laptop / PC - //ocomp.info/kak-postavit-parol-na-noutbuk.html

2) How to configure auto-creation of a backup of documents to the cloud - //ocomp.info/onedrive-chto-eto-kak-ispolzovat.html

When the computer turned on

Windows wouldn't be such a popular system if it didn't have dozens of different useful tools in its arsenal. Now we are talking about the event log, which records:

information about when the computer was turned on and the OS was started;
errors encountered;
warnings, notifications, etc.

To view these entries, we first need to open this the event log ... To do this, press the combination of buttons Win + R , enter the command eventvwr and click OK.

eventvwr - command to call the event log

To help! Other ways to open the event log - //ocomp.info/zhurnal-sobyitiy-v-windows.html

The event log will display tens of thousands of various notifications. Among them, we need to leave only the necessary ones. To do this, click on the tool "Filter the current log" ... See example below.

System - filter of the current log (we will leave only the necessary events) / Clickable

Next, specify specific event codes: 1, 42, 107, 12, 13 (they are responsible for turning on the computer and waking it from sleep mode) and click OK. An example is in the screenshot below.

Note: out of tens of thousands of events, we leave only those that record certain actions.

We leave certain event codes (turning on the PC and exiting sleep mode)

After that, find the event for the date you need and select it: the note will display what happened from the PC (for example, the system resumed operation after sleep mode). Please note that the details also indicate the exact time of the event.

System resumed working from sleep mode

Thus, having looked through the events of the date you need, you can find out when the computer was turned on and check this data with your schedule.

OS startup time / Ie. the computer was turned on

As for how to find out who was working on your PC.

I would recommend installing one of the employee control programs (for example, Clever Control) on your computer. She can record all actions taking place on the computer in the special. journal, monitor working hours, create snapshots from your webcam, and much more.

The bottom line is this: you install this program on your computer (that is, you will control yourself). Next, turn on the options you need and work. When you have any suspicions: just look at the statistics of the control program. This way, you can find out for sure who it was at your workplace while you were away ...

To help! How to keep track of the working time of employees: we will find out what they are doing on the PC -//ocomp.info/kak-vesti-kontrol-deyatelnosti-sotrudnikov.html

Clever Control is one of the programs for employee control / Clickable

However, such software is also good in that it allows you to get detailed statistics on the nature of work on a PC. For example, you can find out in which programs you spend the most time, what time the PC is running, which buttons are pressed, etc. (a lot of very interesting statistics).