SSCC - Winstat Reports

Winstat Reports

Please choose a report to run

Start date

End date

Username*

Server name*

For a prompt response it's best to select no more than a few day period for login time reports

With this report, searching for 'sas' will match all programs with 'sas' anywhere in the path text

To use wildcards, add a * to the beginning or end of the program name

Export to Excel

Last 75 events

Time	Name	Machine	Desc	User	Sess	CPU
09/24/26 04:38:35 PM	Bginfo64	SILO-232	Ended	PRIMO\krvoskuil	30	172
09/24/26 04:38:35 PM	cmd	SILO-232	Ended	PRIMO\krvoskuil	30	78
09/24/26 04:38:35 PM	conhost	SILO-232	Ended	PRIMO\krvoskuil	30	62
09/24/26 04:38:34 PM	Bginfo64	SILO-232	Started	PRIMO\krvoskuil	30
09/24/26 04:38:34 PM	powershell	SILO-232	Ended	PRIMO\krvoskuil	30	984
09/24/26 04:38:32 PM	conda	WINSTAT-220	Ended	PRIMO\ji53	3	16
09/24/26 04:38:32 PM	python	WINSTAT-220	Ended	PRIMO\ji53	3	1062
09/24/26 04:38:32 PM	conhost	WINSTAT-220	Ended	PRIMO\ji53	3	31
09/24/26 04:38:32 PM	cmd	WINSTAT-220	Ended	PRIMO\ji53	3	47
09/24/26 04:38:32 PM	powershell	SILO-232	Ended	PRIMO\krvoskuil	30	328
09/24/26 04:38:32 PM	powershell	SILO-232	Started	PRIMO\krvoskuil	30
09/24/26 04:38:32 PM		WINSTAT-S207	RemoteDisconnect		5
09/24/26 04:38:32 PM	powershell	SILO-232	Ended	PRIMO\krvoskuil	30	469
09/24/26 04:38:32 PM	powershell	SILO-232	Started	PRIMO\krvoskuil	30
09/24/26 04:38:32 PM	svchost	WINSTAT-S207	Ended	PRIMO\wqin8	5	234
09/24/26 04:38:31 PM	python	WINSTAT-220	Started	PRIMO\ji53	3
09/24/26 04:38:31 PM	wscript	SILO-232	Ended	PRIMO\krvoskuil	30	78
09/24/26 04:38:31 PM	powershell	SILO-232	Started	PRIMO\krvoskuil	30
09/24/26 04:38:31 PM	csc	WINSTAT-S207	Ended	PRIMO\wqin8	5	62
09/24/26 04:38:31 PM	gpscript	WINSTAT-S207	Ended	PRIMO\wqin8	5	31
09/24/26 04:38:31 PM	cvtres	WINSTAT-S207	Ended	PRIMO\wqin8	5	16
09/24/26 04:38:31 PM	powershell	WINSTAT-S207	Ended	PRIMO\wqin8	5	359
09/24/26 04:38:31 PM	conhost	WINSTAT-S207	Ended	PRIMO\wqin8	5	62
09/24/26 04:38:31 PM	RuntimeBroker	WINSTAT-S207	Ended	PRIMO\wqin8	5	453
09/24/26 04:38:31 PM	RuntimeBroker	WINSTAT-S207	Ended	PRIMO\wqin8	5	3703
09/24/26 04:38:31 PM	svchost	WINSTAT-S207	Ended	PRIMO\wqin8	5	78
09/24/26 04:38:31 PM	cmd	SILO-232	Started	PRIMO\krvoskuil	30
09/24/26 04:38:31 PM	conhost	SILO-232	Started	PRIMO\krvoskuil	30
09/24/26 04:38:31 PM		WINSTAT-S207	SessionLogoff		5
09/24/26 04:38:31 PM	conda	WINSTAT-220	Started	PRIMO\ji53	3
09/24/26 04:38:31 PM	conhost	WINSTAT-220	Started	PRIMO\ji53	3
09/24/26 04:38:31 PM	cmd	WINSTAT-220	Started	PRIMO\ji53	3
09/24/26 04:38:31 PM	cvtres	WINSTAT-S207	Started	PRIMO\wqin8	5
09/24/26 04:38:31 PM	wscript	SILO-232	Started	PRIMO\krvoskuil	30
09/24/26 04:38:30 PM	csc	WINSTAT-S207	Started	PRIMO\wqin8	5
09/24/26 04:38:30 PM	conhost	WINSTAT-S207	Started	PRIMO\wqin8	5
09/24/26 04:38:30 PM	ctfmon	WINSTAT-S207	Ended	PRIMO\wqin8	5	344
09/24/26 04:38:30 PM	RuntimeBroker	WINSTAT-S207	Ended	PRIMO\wqin8	5	1750
09/24/26 04:38:30 PM	explorer	WINSTAT-S207	Ended	PRIMO\wqin8	5	7094
09/24/26 04:38:30 PM	sihost	WINSTAT-S207	Ended	PRIMO\wqin8	5	641
09/24/26 04:38:30 PM	gpscript	WINSTAT-S207	Started	PRIMO\wqin8	5
09/24/26 04:38:30 PM	powershell	WINSTAT-S207	Started	PRIMO\wqin8	5
09/24/26 04:38:29 PM	SearchUI	WINSTAT-S207	Ended	PRIMO\wqin8	5	2719
09/24/26 04:38:29 PM	ShellExperienceHost	WINSTAT-S207	Ended	PRIMO\wqin8	5	750
09/24/26 04:38:29 PM	taskhostw	WINSTAT-S207	Ended	PRIMO\wqin8	5	94
09/24/26 04:38:29 PM	WfShell	WINSTAT-S207	Ended	PRIMO\wqin8	5	672
09/24/26 04:38:28 PM	CtxMtHost	WINSTAT-S207	Ended	PRIMO\wqin8	5	31
09/24/26 04:38:28 PM	CtxGfx	WINSTAT-S207	Ended	PRIMO\wqin8	5	4516
09/24/26 04:38:28 PM	DefenderSessionHelper	WINSTAT-S207	Ended	PRIMO\wqin8	5	16
09/24/26 04:38:28 PM	notepad	WINSTAT-S207	Ended	PRIMO\wqin8	5	234
09/24/26 04:38:19 PM	Bginfo64	SILO-230	Ended	PRIMO\yok3	6	266
09/24/26 04:38:19 PM	conhost	SILO-230	Ended	PRIMO\yok3	6	156
09/24/26 04:38:19 PM	cmd	SILO-230	Ended	PRIMO\yok3	6	47
09/24/26 04:38:19 PM	Bginfo64	SILO-230	Ended	PRIMO\yok3	6	219
09/24/26 04:38:19 PM	cmd	SILO-230	Ended	PRIMO\yok3	6	62
09/24/26 04:38:19 PM	conhost	SILO-230	Ended	PRIMO\yok3	6	78
09/24/26 04:38:15 PM	powershell	WINSTAT-S207	Ended	PRIMO\wqin8	5	422
09/24/26 04:38:15 PM	smartscreen	WINSTAT-S207	Ended	PRIMO\wqin8	5	94
09/24/26 04:38:15 PM	ChsIME	WINSTAT-S207	Ended	PRIMO\wqin8	5	31
09/24/26 04:38:15 PM	explorer	WINSTAT-S207	Ended	PRIMO\wqin8	5	1750
09/24/26 04:38:15 PM	icak2meng	WINSTAT-S207	Ended	NT AUTHORITY\system	5
09/24/26 04:38:15 PM	AdobeARM_UCB	WINSTAT-S207	Ended	PRIMO\wqin8	5	31
09/24/26 04:38:15 PM	VdaRedirector	WINSTAT-S207	Ended	PRIMO\wqin8	5	47
09/24/26 04:38:15 PM	logoff	WINSTAT-S207	Ended	PRIMO\wqin8	5	47
09/24/26 04:38:15 PM	conhost	WINSTAT-S207	Ended	PRIMO\wqin8	5	78
09/24/26 04:38:15 PM	SCNotification	WINSTAT-S207	Ended	PRIMO\wqin8	5	266
09/24/26 04:38:15 PM	LogonUI	WINSTAT-S207	Started	NT AUTHORITY\system	5
09/24/26 04:38:14 PM	logoff	WINSTAT-S207	Started	PRIMO\wqin8	5
09/24/26 04:38:13 PM	AcroCEF	WINSTAT-S233	Ended	PRIMO\lythjohan	19	78
09/24/26 04:38:13 PM	AcroCEF	WINSTAT-S233	Ended	PRIMO\lythjohan	19	1344
09/24/26 04:38:13 PM	AcroCEF	WINSTAT-S233	Ended	PRIMO\lythjohan	19	156
09/24/26 04:38:13 PM	msedgewebview2	WINSTAT-S233	Ended	PRIMO\lythjohan	19	78
09/24/26 04:38:13 PM	AdobeCollabSync	WINSTAT-S233	Ended	PRIMO\lythjohan	19	266
09/24/26 04:38:13 PM	AcroCEF	WINSTAT-S233	Ended	PRIMO\lythjohan	19	109
09/24/26 04:38:13 PM	Acrobat	WINSTAT-S233	Ended	PRIMO\lythjohan	19	4219
690 million total events