I ran across an awesome little tool recently.
It is called LastActivityView from NirSoft
The program collects information from various sources, and can show you an activity report for a system that includes:
-System logon, shutdown, sleep times
-Software installation time
-System restore point creation
When you launch it, it loads almost immediately with the latest info:
You can even export the data to HTML.
It is a nice little utility to add to your flash drive. Can really help when you are trying to get a timeline of who did what.
One more thing…Subscribe to my newsletter and get 11 free network administrator tools, plus a 30 page user guide so you can get the most out of them. Click Here to get your free tools