Can I find out when my laptop was used?

aliasojo

It has a built in camera but it's disabled. The fact that it's a laptop means you can sit anywhere with it.....I'd need to have a clock on every wall. :)

Yolina

How about just putting the laptop in your bedroom overnight and leaving a note where you'd normally leave it saying that it has been "removed due to unauthorised overnight use"?

Edit: though obviously that won't help you finding out what it has been used for

aliasojo

Can I just clarify that it's not the actual use of the laptop that I'm bothered about....it's the possibility that my eldest is continuing or progressing down a path of unwelcome and provocative behaviour. I need correct information to base decisions about him on. I only wanted to ascertain who used the laptop to either confim or rule out his involvement.

asbokid

intranix wrote: »

When you say it definately shut down, did you just close the lid, press the power button, and did you watch it actually shut down/off. Sometimes a windows service can stop a laptop shutting down.

Similar to the light in the fridge. When you shut the door, you can never be sure that it has gone off. Same with laptops. Learn something new every day!

dogmaryxx

Install http://kidlogger.net/

Enterprise_1701C

asbokid wrote: »

Similar to the light in the fridge. When you shut the door, you can never be sure that it has gone off. Same with laptops. Learn something new every day!

I've solved that one - I have not replaced the fridge lamp!! I KNOW it is off

Mista_C

asbokid wrote: »

Similar to the light in the fridge. When you shut the door, you can never be sure that it has gone off. Same with laptops. Learn something new every day!

Schrodinger's fridge?

Sorry, if he's using a different account than the one you're using you can check that accounts user folder 'last modified' time to see when that account was last logged in.

enigma52

how about a nanny cam

aliasojo

Same thing happened again last night.

Look at this log from event viewer....

Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 12/04/2011 00:00:34
Event ID: 1531
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: Laptop
Description:
The User Profile Service has started successfully.

Compare the time with the time in the log from the previous night.

I'm now inclined to believe this isn't a person starting this up. Why does it say User: SYSTEM?

There's no way would my eldest have been able to start the laptop at almost exactly the same time.

Any more thoughts? I'm pretty stumped.

Please don't suggest I call it Kit or Christine.

The_Grandmaster

If you are worried about infection causing the computer to start, run malwarebytes:
Download and install. Click UPDATE, CHECK FOR UPDATES, and then run a QUICK SCAN. Remove anything it finds and post log here.
Download Malwarebytes Anti-Malware 1.50 - FileHippo.com