Can I find out when my laptop was used?

debitcardmayhem

Then the PC was switched on manually I would assume, if it it was resuming from sleep there should be one like this in event viewer
System - Provider [ Name] Microsoft-Windows-Power-Troubleshooter [ Guid] {CDC05E28-C449-49C6-B9D2-88CF761644DF}
EventID 1 Version 1 Level 4 Task 0 Opcode 0 Keywords 0x8000000000000000 - TimeCreated [ SystemTime] 2011-04-12T12:19:10.931407800Z
EventRecordID 6384521 - Correlation [ ActivityID] {15702CD2-7B9D-4E99-A33D-05DCE7A5B46D}
- Execution [ ProcessID] 1660 [ ThreadID] 4244
Channel System Computer Rob-PC - Security [ UserID] S-1-5-19

- EventData

SleepTime 2011-04-12T12:18:44.594262400Z

WakeTime 2011-04-12T12:19:09.089604500Z

SleepDuration 13305

WakeDuration 2590

DriverInitDuration 2363

BiosInitDuration 399

HiberWriteDuration 0

HiberReadDuration 0

HiberPagesWritten 0

Attributes 20736

TargetState 4

EffectiveState 4

WakeSourceType 4

WakeSourceTextLength 19

WakeSourceText HID-compliant mouse

WakeTimerOwnerLength 0

WakeTimerContextLength 0

WakeTimerOwner


WakeTimerContext

debitcardmayhem

And here is one for wake from Hibernation

  [B]SleepTime[/B] 2011-04-12T11:56:39.862624200Z    

[B]WakeTime[/B] 2011-04-12T12:05:20.734833700Z    

[B]SleepDuration[/B] 20976    

[B]WakeDuration[/B] 19194    

[B]DriverInitDuration[/B] 7802    

[B]BiosInitDuration[/B] 0    

[B]HiberWriteDuration[/B] 19008    

[B]HiberReadDuration[/B] 16348    

[B]HiberPagesWritten[/B] 130651    

[B]Attributes[/B] 16641    

[B]TargetState[/B] 5    

[B]EffectiveState[/B] 5    

[B]WakeSourceType[/B] 0    

[B]WakeSourceTextLength[/B] 0    

[B]WakeSourceText[/B] 
   

[B]WakeTimerOwnerLength[/B] 0    

[B]WakeTimerContextLength[/B] 0    

[B]WakeTimerOwner[/B] 
   

[B]WakeTimerContext[/B] 

aliasojo

Can't see anything like those. Found this ....

[URL="file:///C:/Users/Gill/AppData/Local/Temp/tmpDF4C.xml#"]-[/URL] <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
[URL="file:///C:/Users/Gill/AppData/Local/Temp/tmpDF4C.xml#"]-[/URL] <System>
<Provider Name="Microsoft-Windows-EventSystem" Guid="{899daace-4868-4295-afcd-9eb8fb497561}" EventSourceName="EventSystem" />

<EventID Qualifiers="16384">4625</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2011-04-11T23:00:34.000000000Z" />

<EventRecordID>12811</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>Application</Channel>

<Computer>Laptop</Computer>

<Security />

</System>


[URL="file:///C:/Users/Gill/AppData/Local/Temp/tmpDF4C.xml#"]-[/URL] <EventData>
<Data Name="param1">86400</Data>

<Data Name="param2">SuppressDuplicateDuration</Data>

<Data Name="param3">Software\Microsoft\EventSystem\EventLog</Data>

</EventData>


</Event>


then this.....


[URL="file:///C:/Users/Gill/AppData/Local/Temp/tmpDF4C.xml#"]-[/URL] <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
[URL="file:///C:/Users/Gill/AppData/Local/Temp/tmpDF4C.xml#"]-[/URL] <System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />

<EventID>1531</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8000000000000000</Keywords>

<TimeCreated SystemTime="2011-04-11T23:00:34.476026300Z" />

<EventRecordID>12812</EventRecordID>

<Correlation />

<Execution ProcessID="940" ThreadID="1136" />

<Channel>Application</Channel>

<Computer>Laptop</Computer>

<Security UserID="S-1-5-18" />

</System>


<EventData />

</Event>



That's all I can find relating to the start up at that time. Anything relevant or not?

debitcardmayhem

If there any before this as this "Microsoft-Windows-Power-Troubleshooter" then it sounds/looks like power on then , unless your laptop is near your big toe then it looks probably it's one of the others in the household.

aliasojo

One way to find out I guess...

*goes off to make sandwiches and a flask of soup for the midnight vigil*

aliasojo

Didn't stay up till midnight last night. Shut down laptop as usual, but also unplugged from mains and took battery out.

Just plugged back in this morning and laptop immediately came on (I normally have to press the power button to switch it on). There's definitely something not right but I don't know what.

One thing I did notice (not sure if it's an issue or not) is that Task Manager showed all the running processes and all but 2 had an entry in the 'user name' column. So everything was listed as running under my user name except csrss.exe and winlogon.exe which had nothing in the user name column and nothing in the description column. I know these can be genuine Windows processes but every other windows process has an entry under both headings so might these be corrupt?

jayme1

aliasojo wrote: »

One thing I did notice (not sure if it's an issue or not) is that Task Manager showed all the running processes and all but 2 had an entry in the 'user name' column. So everything was listed as running under my user name except csrss.exe and winlogon.exe which had nothing in the user name column and nothing in the description column. I know these can be genuine Windows processes but every other windows process has an entry under both headings so might these be corrupt?

my csrss.exe and winlogon.exe also have no username and description too so I would say there is nothing wrong there.

you can set a password for your user account and stop the access.

aliasojo

Think I might have found the culprit.....'HotStart'.

The Windows Vista® and Windows® 7 operating systems provide built-in support for launching applications directly from system startup. Windows HotStart™ takes advantage of existing support in Windows Vista and Windows 7 for OnNow power management initiatives and technologies, including the platform sleep states and wake capabilities that are defined by the Advanced Configuration and Power Interface (ACPI) specification and supported by the Windows Driver Model (WDM), the underlying operating system, and platform hardware.
Manufacturers can take advantage of Windows HotStart to add consumer-friendly application-access buttons through chassis front panels or infrared (IR) remote controls to their system designs. A common example of such a control is a media playback button that starts or wakes the computer and immediately (as soon as the system is running) presents the user with a media player or dedicated media shell.
So if this is linked, how do I find out which application started it?

Task scheduler has HotStart running just after midnight last night but there is no further info about the process.




Edit:

Log Name: Application
Source: SignInAssistant
Date: 01/05/2011 00:00:39
Event ID: 0
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Laptop
Description:
The description for Event ID 0 from source SignInAssistant cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
g_WLIDTimerQueue.Initialize started (00:39:795)

missile

aliasojo wrote: »

He has his own laptop.

His reasoning for using mine (if indeed it was him) wouldn't have been as simple as *just* wanting to go on the internet or whatever. His actions can be complex and are often not for nice reasons. Part of his difficulties unfortunately.

Password protect YOUR laptop and he cannot access it:j

aliasojo

missile, it's not him.