How to See Who Logged Into a Computer (and When)?

                      How to See Who Logged Into a Computer (and When)?

Do you want to see who logged into your computer and when? If yes, You can easily monitor the user login activity by enabling logon auditing which is the feature of the windows operating system.

The Audit logon events setting tracks both local logins and network logins. Each logon event specifies the user account that logged on and the time the login took place. You can also see when users logged off.

Note:- The audit logon works on all versions of Windows except the Home edition. It should work on windows 7, 8, 10 as well as windows server  2008, 2012,2016, and 2019. We are going the cover windows 10 in this article.

Here you go with the simple steps;-

Enable Logon Auditing

In order to enable login audit, you will have to use the local group policy editor.

To open the Local Group Policy Editor, hit Start, type “gpedit.msc,“ and then select the resulting entry.
After opening the local group policy, please go to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy. In the right-hand pane, double-click the “Audit logon events” setting.

Double click on Audit Logon events, you will see the properties of the same, enable the “Success” option to have Windows log successful logon attempts. Enable the “Failure” option if you also want Windows to log failed logon attempts. Click the “OK” button when you’re done.

You are done here, close the local group policy editor windows.

View Logon Events.

Once you enable the Logon Audit, windows start to keep the record of the login event. You will able to see logon events through event viewers.

To open the event views. Hit the start and type “event,” and then click the “Event Viewer” result.
In the “Event Viewer” window, in the left-hand pane, navigate to the Windows Logs > Security.

After that, you will need to look for event ID(4624), if you scroll down you can find that but you will have to keep an eye on the event ID. I would like to recommend you to go filter options search for event id.

Then after just a bit on the details, you can see the information you’re after—like the user account name.

If you have any queries or you are still missing some detail about this, please do comment, we will keep you posted regarding this issue.

Related Posts

1 Comment

Leave a Reply

Your email address will not be published. Required fields are marked *