Easily View How Long Users Are Logged On For With WinLogOnView

Want to quickly find out when users on your PC logged on and off – and how long they spent on the computer? WinLogOnView is another new free utility from Nir Sofer – it’s a simple tool to detect the time and date ranges that users logged on and off.

One common use might be to check up on how long a child is spending on their PC – they have a habit of claiming they were only on ‘for a few minutes, honest’!

The utility gets its information by analyzing the Windows event log – note that, if you clear the Security event log, there will no longer be any data for it to display…

Although you could eventually track down the same data by looking in the event log itself, this utility is a welcome improvement as it strips out only the relevant times, making it easier to see how long the user has been on the PC for.

WinLogOnView is a tiny free program and doesn’t need to be installed – it works on Vista, Windows 7 and Windows 8 (not XP). For every time duration that a user logs on or off, it displays the following information as shown in the illustration below:

  • Logon ID
  • User Name
  • Domain (usually Workgroup unless you are on a business network)
  • Computer (Name)
  • Logon Time
  • Logoff Time
  • Duration
  • Network address (usually – the localhost i.e. this computer)


All columns in the table are sortable – e.g. click on ‘Duration’ column heading to sort the entries ordered by the length of time logged on. The utility can also provide the same information for a remote PC on your network if you have sufficient access rights (to read the event logs remotely).

How To Use WinLogOnView – Download the program in a zip file from Nirsoft at the bottom of the page here.

Unzip (extract) the zip file and run the .exe program file to open the program – anyone used to NirSoft utilities will be familiar with the layout and find their way around easily.

As is common, you can select one or more entries in the table and copy/paste them or export them into a csv/tab-delimited/html/xml file by using the File \ Save Selected Items menu bar option (Ctrl+S hotkey) or by selecting the floppy disk icon.

Note: only full Logon and Logoff cycles are reported and the data is dependent on what Windows has stored in the Security event log.

To access data for a remote PC on your network, press F9 (or Options\Advanced Options from the menubar), choose Remote Computer as the data source and type in the computer name. It is also possible to access data from an external disk if the Security event log (security.evtx) file is stored there.


The utility is a quick and portable way to display or save/print the logon and logoff history of a PC – either local or remote. Unlike wading through the Windows event logs, this lets you see just the relevant data in one table which saves a lot of time.