Described is a technology by which logged events such as in a security event log (e.g., within a defined timeframe) are processed to determine logon times and logoff times, which are then used to determine system usage. Logoff times may correspond to an actual logoff event, a shutdown event, or another login. In one example, logon and logoff times determine the combined times that each user of the system was logged on, e.g., a total session time for each user. Multiple users' times may be combined into a total usage time of all users. Each user's combined session time may be evaluated against the total usage time to determine whether any user is a primary user, e.g., by being logged on more than a threshold percentage of the total usage time. A primary user may be identified, or the system determined to be a shared system without a primary user.