Tracing log ons/log offs on local pc

[gexamb]

I have an interesting question to ask regarding the Event Viewer in Win Xp Pro.

Now in the system tab in the event viewer, there are two entries named "eventlog" as the Source, events 6005 and 6006.

6006: The Event service has stopped.
6005: The Event service has started.

At what point when the computer is shutting down or starting up, does this event get recorded? What I mean to say is, for example when the computer is shutting down, this is the very last event that gets recorded, correct?

Now is it possible during the shutdown process, that this service stops but the computer for some reason does not log off and stays logged on? For example some error occurs, or for some reason the log off/shutdown process gets stuck, stops the Event log service, but the computer is still logged on, is this possible?

From the event viewer log that I am looking at, it seems that the "Event service has stopped" gets recorded after the computer is logged off or at least at the point where it says "windows is saving your settings" (the message you get when you log off or shutdown). if this is correct, then the computer is already at the point where the desktop has disappeared, and the message box pops up stating that it is shutting down, or saving settings, or disconnecting network connections, or whatever. if the event service stops at this point, then there is no way that the log off process would be stuck and the computer would still be logged on, correct?

Please tell me if this makes any sense to anyone. Any and all comments, suggestions, feedback is and would be extremely appreciated. This is a very important matter to me, please shed some light on this. Thanks to all.

 

[LookinAround]

Now is it possible during the shutdown process, that this service stops but the computer for some reason does not log off and stays logged on? For example some error occurs, or for some reason the log off/shutdown process gets stuck, stops the Event log service, but the computer is still logged on, is this possible?

Not clear what your concern is but first fundamental question: Do you see the computer shutdown? Or are you seeing it just hang during the shutdown process? If it shuts down, you're logged off and everything is closed.

If you want to know about user logon/logoffs, try this

Start->Run, enter secpol.msc
Look under Security Settings->Audit Policy
Double click to open Audit account logon events
Check both Success and Fail, click OK
Reboot and run your tests again​

You'll now also see user account logon/logoff attempts and status

Note: You will also an option to log Audit logon events. This audit can create many different additional types of logon events that might confuse what you're looking for you can try with and without it enabled.

You may also find the Event Logs even easier to sort through/manage if you use Event Log Explorer

 

[gexamb]

im sorry it took so long to respond.

I was not present when this log on/off event occurred. I am trying to figure out if in event viewer it says "event service has stopped" then that means that the computer is logged off, correct?

is there any way that this service was stopped, but the computer was still logged on when a user tries to shutdown or log off?

What i am trying to do is figure out if a computer was actually shutdown/logged off or if it was still logged on for a specific date that is recorded in the Event Viewer.

 

[LookinAround]

The "event service has stopped" event implies the computer was shutting down (as well as users being logged off)

So if you see "event service has stopped" and then another indicating it;s starting, is most probably the computer was shutdown during that time. (But of course nothing is 100% with computers as there's also a condition that isomeone on the computer knows how restart the event service and didn't do a shutdown)

 

[gexamb]

ok great. thats all i needed to know.

Ya and no one here has the intelligence to know how to stop and start services but me. Great work, you helped me get rid of any doubts I had. Thank you for your help.