How to Filter Event Logs by Username in Windows 2008 and higher

In Windows Server 2003 or Windows XP, you could easily filter the events in the system Event Log Viewer by a specific user account if you enter the desired username in the User field of the log filter. But in Windows Server 2008 / Windows 7, this simple way of finding events related to the specific user does not work.

In Windows Server 2008, there is no User field in the standard presentation of the event log. Let’s try to add it using View -> Add/Remove Columns menu option.

Now the User column has appeared in the log presentation, but the name of the user who initiated an event is not displayed in this column. We can see N/A instead. The information about the account is now contained in the description of the event itself (in the values of Security ID and Account Name in this example). How to filter the events in the log now?

To filter the events by the username (or any other event attributes) in Windows Server 2008 or higher, you can use manual modification of XML queries (XPath).

So, open the log you need in the Event View (in our case, it is the Security log) and select Filter Current Log… in the context menu.

Go to the XML tab and check Edit query manually.

Copy and paste the following code that allows to select all events of the specific user in the log (replace username with the account name you need).

Save the changes in the filter and look at the log. Only events related to the account you specified should stay in the log.

If you need, for example, to additionally filter the events for a user and Event ID 4624 (An account was successfully logged on) and 4625 (An account failed to log on.), the XPath filter will look like this:

How do I view login history for my PC using Windows 7

I want to see the login history of my PC including login and logout times for all user accounts.

I want to see the login history of my PC including login and logout times for all user accounts.

You can also use Windows® Even Viewer, to view log-in information.

How can I: Access Windows® Event Viewer?
1. Press + R and type “ eventvwr.msc” and click OK or press Enter.
2. Expand Windows Logs, and select Security.
3. In the middle you’ll see a list, with Date and Time,Source, Event ID
and Task Category. The Task Category pretty much explains the event,
Logon, Special Logon, Logoff and other details.

I hope you find this information useful. If you need any further assistance,
please feel free to contact me and let me know.

I hope this information was helpful…

Have a nice day…

Best regards,
Fisnik

Itknowledge24.com — Follow me on Twitter: http://twitter.com/itknowledge24
— UAC Trust Shortcut 2.0 is on its way.

145 people found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

Get current logged in user name command line (CMD)

In Windows OS, we can find the current logged in username from windows command line. The logged in user information is stored in environment variables. So just by printing the value in these environment variables we can get to know the login name.

To know the login name of the currently logged in user we can run the below command.

This works on all releases of Windows OS(Windows XP, Server 2003, Windows Vista and Windows 7).

There is another command whoami which tells us the domain name also.

Both of these options to find user name can be useful in batch files to write code in such a way that it works for every user. For example, if your batch file need to access a user specific folder, say Application data, then you can refer the directory as ‘C:\users\%username%\appdata‘.

how to know the current user password in windows 7?

run cmd in admin mode and type net user (user name) (12345)
then your password change to 12345

Use this command:
net user “%username%” “%random%%random%%random%%random%%random%”

Suggestion to use command:
net user “%username%” “%random%%random%%random%%random%%random%”
will change your current users password to something completely random

I don’t think it would be possible to find the password as it is stored in encrypted form and not in plain text. However, there are lots of third party tools to reset a administrator password if you have forgotten the same.

when i go onto command promt it says my username is “user” and say c:/users>user

I HAVE THE SAME PROBLEM. HAVE YOU SOLVE YOUR PROBLEM YET?

The whoami command does not work in Windows XP without the SP2 Support Tools download. The command is not native to the OS. http://www.microsoft.com/en-us/download/details.aspx?id=18546

Can the %username% command be used to determine the user logged into a differnent computer. ex I am at computer x and want to know who is logged on to computer y. I can remote to the c drive using RDP \\computery\c$ I would also like to definively likt to know who is logged on to that computer. Possible?

No, it does not work that way. %username% always shows the user of the current login session. When you run it on remote computer, I am not sure what you would get but it won’t tell you who logged on to the machine.

You can use PSEXEC to run a command on another PC. It can be found in the PS Tools package available for download on many sites.

With System Internal tools (free http://technet.microsoft.com/en-us/sysinternals/bb897545.aspx )
psloggedon \\targetComputer
or
psloggedon \\192.167.0.0

Is it possible to get current User Name when it’s an AD where each user has an ID?
For example, if I run whoami or %username% I get “XX00000” but I want to get “Name SecondName”. I know windows has this info because I see my full name in Start Menu (Win 7).
Thanks

net user %username% for accounts stored in local or net user %username% /domain for accounts stored on domain.

you know this answer…?… anyone please let me know solution for georges’ question.. thanks in advance..

I would also really like a solution for this

If you are asking to find the full name or Surname run this as administrator.
net user
It will show you all the information about that user, full name, logon time, the group this user belongs to, the time it is allowed to login all of that.

When I run whoami from the cmdline I get my username. However I want to find my username from within SQL Server. If I shell out and run whoami I get the sql service user . Any ideas?

what username lets you look at the history

what does it mean by username

Please show screen shot

I have 2 accounts one for me and one for my nephews and nieces so I forgot my password because it makes me change it every other month it seems like and idk why… but I looked up a way to change it by going into the command prompts but it’s only giving me the kids for net user it says mine doesn’t exist I could use some help asap

I need to find my administrator account password when its logged in so is there way i can do it from cmd to find my password without changing it ?

does we have a vraiable like %username% for user group name ?

How to get logged-in user’s full name in windows?

How to get logged-in user’s full name (the one he/she entered as his/her real name) using windows API or something else? For example how to get «John Smith», not «john» (as it were his username).

GetUserName(. ) doesn’t do the job because it returns the username, not the full name.

6 Answers 6

Did you try GetUserNameEx(NameDisplay. )?

A quick Google reveals that NetUserGetInfo should do this. It doesn’t look like the easiest API in the world to use.

I think the level you’re after is 10, which returns a USER_INFO_10 structure, containing, among other things, a usri10_full_name .

Make sure you remember to free the structure when finished, using NetApiBufferFree!

Well, if the user never entered it, there’s no way for you to get it. You could look for installed email programs and politely ask them for the info, but that’s a bad idea for many reasons.

Here’s your best shot: Get the name the user entered when registering the copy of Windows. This is in the registry. The exact location differs between Windows versions, but in recent versions, it’s at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion (and in Windows 95/98/ME, at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion ).

In there, you’ll find RegisteredOwner, which is where the was supposed to enter the name. Obviously, if this is a company computer and the machine was set up by IT, it’s very common to find a standardized company string there. And, of course, lots of people will enter names there like «Joe Sixpack» or «Cracked by Quartex». However, that’s as close as you can get.

How do I get the current Windows logged-in user’s username?

I am developing an intranet application using ASP.NET MVC 4. I am using custom forms authentication. When the user accesses the application I want to take the user’s Windows logged-in username and check that username in my database. But I don’t know how to take that username. I try to take it using the following code:

This gives me the username when I run from Visual Studio, but when I host my application on IIS it gives a weird value. I also tried to use

but no use. Is there a way to get the user’s Windows logged-in username before authentication?

1 Answer 1

It sounds like you may need to consider mixed-mode authentication. I.e. Windows and Forms authentication. The thing is they don’t necessarily play well together.

The following article describes the problem and how to overcome it. The thrust of the article centres around how a 401 challenge (Windows authentication) and 302 redirect (forms authentication) are incompatible in > IIS 7 integrated mode and a way to use a couple of forms and HTTP pipeline interception to get at user details. I used the approach successfully for a large public sector client (albeit for a webforms application). I’m sure the principles are the same.

I forgot to add in the code examples the right place to look for Windows authentication credentials are presented. It’s been a while, so I can’t remember it off the top of my head.