WinLogOnView

WinLogOnView processes information from logs about security events occurred in Windows, in order to let you determine when users logged on and off, the session duration, and others. This data can be exported to file.

Since the program's wrapped in a portable package, you can just save its executable file in any part of the hard drive or on a removable storage unit to directly launch it on any computer. It doesn't need any DLLs and doesn't create registry entries.

It's packed in a user-friendly interface, where information is immediately loaded into the main window after launching the app. You can check out the logon ID and type, user name, domain, computer name, log on and off time, session duration, along with the network address for each event.

All or just selected items can be copied or saved to file in text, CSV, HTML or XML format. You can jump to a specific event using a basic search tool, show grid lines, mark even and odd rows with different colors to tell them apart easier, or show global time instead of local.

Another aspect worth noting is that WinLogOnView can not only analyze security log data obtained from the local host, but also from an external disk or remote machine. It must find the Event Log folder which contains the security.evtx file. Command lines are supported for users who prefer the console window over the GUI.

Unsurprisingly, it had minimal impact on the computer's performance in our tests, running on low CPU and RAM. No error dialogs popped up and it didn't hang or crash.

To wrap it up, WinLogOnView offers a simple and effective solution for quickly examining useful information recorded in security event logs, and it can be handled by anyone.