Work computer login history?

ooter

Just wondering if it is common practice for companies/HR depts to use work computer login history to record attendance at work?
I am in dispute at the moment with my section in work over my attendance record, they are claiming I wasn't in on a particular day and I know that I was. Attendance is recorded manually in to books in my section, they have obviously made an error but are not backing down. The thing is I work on a computer that I have to log in to every morning and after a period of inactivity during the day I have to log in again so HR should have a record of my login/attendance on that day.
It's just at a local level at the moment but could I request that information from HR, would it be common practice to hold information like that on record?
I suppose I could just ask HR but I thought I'd ask on here before pulling that rabbit from the hat.

mickoneill31

ooter wrote: »

Just wondering if it is common practice for companies/HR depts to use work computer login history to record attendance at work?
I am in dispute at the moment with my section in work over my attendance record, they are claiming I wasn't in on a particular day and I know that I was. Attendance is recorded manually in to books in my section, they have obviously made an error but are not backing down. The thing is I work on a computer that I have to log in to every morning and after a period of inactivity during the day I have to log in again so HR should have a record of my login/attendance on that day.
It's just at a local level at the moment but could I request that information from HR, would it be common practice to hold information like that on record?
I suppose I could just ask HR but I thought I'd ask on here before pulling that rabbit from the hat.

They might not have the information. Your pc will record you logging in but those logs get overwritten after a few days usually.
If they back up the logs they'll have the details.

How about emails. If you sent or replied to emails on the day would that be proof. That is something that will be more likely to be stored.

ooter

On the day in question I only received a few emails unfortunately, didn't send any.
Would it be more usual or unusual to back up the logs?

TallGlass

ooter wrote: »

On the day in question I only received a few emails unfortunately, didn't send any.
Would it be more usual or unusual to back up the logs?

Internet search history, phone logs, bank statements to show lunch near place of work etc..

I don't understand this one, really, how do they not know you where there or not?

runawaybishop

Windows event viewer will have your login event. Those logs shouldn't be wiped and are stored locally.

ooter

runawaybishop wrote: »

Windows event viewer will have your login event. Those logs shouldn't be wiped and are stored locally.

Honestly never heard of that before, will check tomorrow, would that be on all/most PC's?

runawaybishop

ooter wrote: »

Honestly never heard of that before, will check tomorrow, would that be on all/most PC's?

Yes, there will be an event viewer/system log on windows, Linux, Unix etc.

What operating system is it?

handofdog

That would only prove that someone logged in as you - unless you log in with biometric data.

It doesn't prove that you were there.

I'm not saying that you weren't there - just that someone could claim that a login isn't necessarily evidence of attendance.

ooter

runawaybishop wrote: »

Yes, there will be an event viewer/system log on windows, Linux, Unix etc.

What operating system is it?

Windows but it's a fairly old PC, I'd say at least 10 years old.

handofdog wrote: »

That would only prove that someone logged in as you

How would anyone else know my password?

dennyk

HR most likely doesn't have that information, unless the company has specifically implemented a dedicated attendance tracking system which explicitly uses workstation login data, but your IT department might have logs of your logins, or they may be able to show you how to retrieve your local workstation's own logs. Check with someone at your IT helpdesk and see if they can assist.

runawaybishop

ooter wrote: »

Windows but it's a fairly old PC, I'd say at least 10 years old.


How would anyone else know my password?

Eventviewer will have it so.

boogerballs

runawaybishop wrote: »

Windows event viewer will have your login event. Those logs shouldn't be wiped and are stored locally.

d

This is wrong, while Event Viewer will have Audit logs for authentication events they do get overwritten by default so depending on how long ago it was they may not be there. To keep the logs over a long time they need to be exported.

To the OP - is there any applications that you login on the PC as they may have better audit logs. Also, the internet history might have some pages that are unique to your login so that might be an option.

Off topic though, surely it is up to the employer to prove you were NOT there instead of the employee proving they WERE there?

_Brian

Other people could log in with your credentials so it’s not exact proof that you were there.

ooter

..

iPhone.

Any CCTV available? Also a lot of places now would have door access systems which record entry in and out with Swipe cards which are assigned to individual staff, IT or facilities management may maintain the logs.

Did you send any documents to print that day, get IT support to check the print logs?

Did you make any phone calls, a lot of offices also record calls, again get IT to check the calls if you made some.

Did you send any letters out that day, if so check the date on any letters you sent. Also if you sent any registered mail items they should be recorded in your office log book.

runawaybishop

boogerballs wrote: »

d

This is wrong, while Event Viewer will have Audit logs for authentication events they do get overwritten by default so depending on how long ago it was they may not be there. To keep the logs over a long time they need to be exported.

To the OP - is there any applications that you login on the PC as they may have better audit logs. Also, the internet history might have some pages that are unique to your login so that might be an option.

Off topic though, surely it is up to the employer to prove you were NOT there instead of the employee proving they WERE there?

You're right, they aren't archived by default. The Auth logs should go back a long time though.

Paranoid Bob

Get legal advice.

Check your contract, employee handbook and any other documentation from the employer about terms of employment, attendance, disciplinary procedures, etc.
As a rule they can only use data that they told you they were collecting, and then only for the purposes they told you about. Anything else is probably contrary to data protection legislation.
You will probably find a general statement about monitoring computer usage, but often that will be connected to an acceptable use policy (basically a document that says don't do anything stupid / illegal / immoral using company resources). If it does not mention using that monitoring for attendance records then they probably cannot use it for that purpose.

Again; get legal advice and don't trust a random stranger on the Internet.

screamer

A company that logs time in a book won't have any sort of sophisticated log system. Don't understand how they can prove you were there or not a book written into is wide open for error. What's your real fear with this, it's not about the logs or attendance are they talking disciplinary action? Or non payment of wages?

Dial Hard

Paranoid Bob wrote:

Check your contract, employee handbook and any other documentation from the employer about terms of employment, attendance, disciplinary procedures, etc. As a rule they can only use data that they told you they were collecting, and then only for the purposes they told you about. Anything else is probably contrary to data protection legislation. You will probably find a general statement about monitoring computer usage, but often that will be connected to an acceptable use policy (basically a document that says don't do anything stupid / illegal / immoral using company resources). If it does not mention using that monitoring for attendance records then they probably cannot use it for that purpose.

Did you actually read the OP?

Paranoid Bob

Dial Hard wrote: »

Did you actually read the OP?

Apparently I only skimmed it.

beauf

_Brian wrote: »

Other people could log in with your credentials so it’s not exact proof that you were there.

Generally you can trace people activity also by file creation and modification dates and emails, and even printer logs. It will also be on other peoples email if you've sent any.

ooter

No I'm missing out on a day's annual leave which is not a huge deal in the grand scheme of things and part of me is wondering whether it's worth the hassle but I was definitely in on the day in question.
In this day and age, manual recording of attendance is ridiculous but sure there you go.

AllForIt

Why do they think you weren't at work? They must have said? How many days? Just the one or a few?

Unless it was going back a considerable period of time and your computer wasn't reset, there should easily be a way to find out if you logged into your computer at work, multiple different ways actually.

ooter wrote: »

No I'm missing out on a day's annual leave which is not a huge deal in the grand scheme of things and part of me is wondering whether it's worth the hassle but I was definitely in on the day in question.
In this day and age, manual recording of attendance is ridiculous but sure there you go.

EDIT: Sorry I didn't see this, I only read the OP. If this is what it's about then it's hardly worth fretting over but yes, you can find out from your PC usage.

beauf

ooter wrote: »

...
In this day and age, manual recording of attendance is ridiculous but sure there you go.

Manual recording is still valid. Often computer logs are inaccurate.

Dravokivich

ooter wrote: »

No I'm missing out on a day's annual leave which is not a huge deal in the grand scheme of things and part of me is wondering whether it's worth the hassle but I was definitely in on the day in question.
In this day and age, manual recording of attendance is ridiculous but sure there you go.

It is a big deal. They can't just say you were out that day, when they don't have a proper system in place to support it. They are taking a day off from you, that you dispute you've worked. And they can't prove you didnt.

Who's to say they won't do that again or haven't before?

It's not your fault, you shouldnt take the hit no matter how trivial it may seem.

jamesbere

How long ago was this, surely someone must of seen you in work. You should ask them what evidence they have.

ooter

Thanks for all the replies lads, found event viewer on my PC this morning and went in to windows logs and then double clicked on application and a huge list of over 4,000 "events" came up dating back to June of last year, a lot of it made no sense to me but it was pretty clear that there was activity on the date in question and the computer was definitely switched on and logged in to, I always shut my PC down at the end of the day. On days when I wouldn't have been in work (Saturday/Sunday) there's no activity at all so if I wasn't in on the day in question surely there'd be no activity on the list?
Haven't pointed this out yet but it looks like I have the info I needed.