If you find such a record, you will know for sure that someone was snooping around. You can’t tell who did it from looking at the logs, but you sure can figure out when it was used behind your back. You can see as far back as two weeks, so you can scroll down and find the exact time someone used your computer without permission.Īgain, it’s critical that you keep track of the last few times you used the computer. You will get a list of every time your Mac was awakened. Type “Wake reason: EC.LidOpen” without the quotes.If you don’t have the left sidebar, click on “Show Log List” first, and expand /private/var/log. Click on the kernel.log found in the left sidebar.Click on the Spotlight icon and enter “Console” in the search bar.The information you end up with is not as accurate and precise as what you get from Windows, but it’s still good enough to give you an idea of what’s going on. The Get-WinEvent command will go through the logs looking for the 1074 Event ID and return the results in a neat table with the Format-Table -wrap command.Ĭhecking your last shutdown time on Mac is a little trickier. I won’t go into a lot of detail about the command for the sake of brevity. Next, type in ‘ Get-WinEvent -FilterHashtable = ‘System’ id = 1074} | Format-Table -wrap‘ and hit Enter.Click the Start menu and type ‘ win‘ into the search bar, you can type out ‘ windows powershell‘, but it isn’t necessary. Start by opening the Windows PowerShell app. If you like to use PowerShell, then you’ll enjoy this tutorial on viewing a PC’s last shutdown time. How to Check the Last Shutdown Time Using the Event Viewer Using Windows PowerShell A System event with an ID of 1074 is a shutdown, so you query the System logs for that ID and print it to the command prompt. I won’t go into too much detail about the above command, so here’s a quick and simple breakdown.
0 Comments
Leave a Reply. |