Track your work Start and End times via a Custom XML Filter in Windows Events.

Do you ever forget when you started or ended work and want an easy way to figure it out on a PC?

If you try looking at Windows Event Viewer > Security - out of the box --- it's info overload and hard to find anything.

Most threads online will say to just filter by ID 4624 for Logons - but this gives you thousands of false positives (system rather than user-actions) and if you're just a Home PC user your account is likely an 'admin' (special priviledge account) with a different ID of 4672.

My recommendation - custom filter based on Username.

Here's how you make a custom view that filters based off YOUR logon.

It only takes a few minutes.

1. Click Start

2. Type Event > Select "Event Viewer" (consider Right clicking and "Add to Taskbar" to have it easily available in the future).

3. In Event Viewer: Right Click "Custom Views" > Select "Create Custom View"

4. Click XML Tab > Select "Edit Manually", then accept the warning.

5. Paste the XML code in blue below - and change "USERNAME" to your username (note, it's likely your outlook.com email or something like that).

6. Save it > Title it: Logon-Logoff.

7. Enjoy the more succinct list.

<QueryList>

<Query Id="0" Path="Security">

<Select Path="Security">

*[System[(EventID=4625) or (EventID=4800) or (EventID=4801) or (EventID=4802) or (EventID=4803) or (EventID=4647)]]

or

*[EventData[Data[@Name='SubjectUserName']='USERNAME'] and System[(EventID='4672')]]

</Select>

</Query>

</QueryList>