See Who Has Logged Into Windows 10

Edited by Jay

If you're the system administrator in your household, and you share a PC with multiple people, you may want to monitor who's been logging in from time-to-time. With the Logon Auditing Policy enabled, you can see who's been using your device, along with any attempts users have made to log in. In addition to checking local accounts, you can also see network sign-in attempts as well. You'll be able to view both successful and failed login attempts, along with the name of the account, the time they tried to sign-in, plus some other information too.

Was this helpful? Yes | No| I need help

So if you suspect your roommate or sibling has been trying to hack into your device, you'll be able to see a record of all the attempts, and better yet, be able to prove it! Although this feature is typically reserved for professional environments, it still has some practical use for home users as well.

Was this helpful? Yes | No| I need help

In the following VisiHow guide, we'll go through the steps for enabling the logon audit policy, and also how to use the event viewer to check on who's been logging in. For this article, we used a Sager laptop running Windows 10 Professional.

Was this helpful? Yes | No| I need help

**Please Note** Editing the group policy isn't available for Windows 10 Home users. However, successful login auditing comes turned on by default. So if you're using Windows 10 Home edition, you can jump directly to the section on using the Event Viewer.

Was this helpful? Yes | No| I need help


Enable Audit Account Logon Events Via Group Policy in Windows 10

  1. 1
    Using your keyboard, press the Windows key + R at the same time.
    Advertisement
    Was this step helpful? Yes | No| I need help
  2. 2
    When the Run command window appears, type; "gpedit.msc" (without the quotes), then click "OK".
    Advertisement
    Was this step helpful? Yes | No| I need help
  3. 3
    From the Local Group Policy Editor window, double-click "Computer Configuration".
    Was this step helpful? Yes | No| I need help
  4. 4
    Under the Computer Configuration section, double-click "Windows Settings".
    Was this step helpful? Yes | No| I need help
  5. 5
    In the Windows Settings section, double-click "Security Settings".
    Was this step helpful? Yes | No| I need help
  6. 6
    Under Security Settings, double-click the "Local Policies" folder.
    Was this step helpful? Yes | No| I need help
  7. 7
    From Local Policies, double-click "Audit Policy".
    Was this step helpful? Yes | No| I need help
  8. 8
    Under Policy, double-click "Audit account logon events".
    Was this step helpful? Yes | No| I need help
  9. 9
    In the Account logon event window, place a checkmark next to; "Success" and "Failure" in the Audit these attempts section, then click "Apply".
    Was this step helpful? Yes | No| I need help
  10. 10
    Next, click "OK" to close the Audit properties window. With the above steps completed, Windows will now track all login attempts on your machine, whether they were successful or not.
    Was this step helpful? Yes | No| I need help


Use Event Viewer to Check Login Attempts in Windows 10

  1. 1
    Using the taskbar search function, type "event viewer" (without the quotation marks)
    .
    When the results return, click the first option at the top.
    Advertisement
    Was this step helpful? Yes | No| I need help
  2. 2
    In the Event Viewer window, double-click "Windows Logs".
    Was this step helpful? Yes | No| I need help
  3. 3
    In the Windows Logs section, double-click "Security".
    Was this step helpful? Yes | No| I need help
  4. 4
    Here in the Security section, you'll see all the logon attempts
    .
    Double-click the log that displays the Event ID 4624.
    Was this step helpful? Yes | No| I need help
  5. 5
    In the top section of the event properties window, you'll see the account name of the person who signed-in
    .
    Also, below in the Logged section, you'll see the time and date this user signed-in. If when you're back in the Security section, you see Event 4740, this indicates that a user was locked out for entering the wrong password too many times.
    Was this step helpful? Yes | No| I need help
  6. 6
    You can also create a custom view to access certain logged events much quicker
    .
    Right-click "Custom Views", then click "Create Custom View".
    Was this step helpful? Yes | No| I need help
  7. 7
    In the Create Custom View window, select "By Log"
    .
    Then, using the drop-down arrow in the Logged section, select a time range.
    Was this step helpful? Yes | No| I need help
  8. 8
    While still in the Create Custom View window, expand the drop-down next to "Event Logs:", then select "Security".
    Was this step helpful? Yes | No| I need help
  9. 9
    Finally, while still in the Create Custom View window, enter the event ID "4624" (without the quotes), then click "OK".
    Was this step helpful? Yes | No| I need help
  10. 10
    Next, enter a name for your custom view, then click "OK". Now you'll be able to pull the logs on all sign-in attempts much faster.
    Was this step helpful? Yes | No| I need help

If you have problems with any of the steps in this article, please ask a question for more help, or post in the comments section below.

Comments

VisiHow welcomes all comments. If you do not want to be anonymous, register or log in. It is free.

Article Info

Categories : Use Windows 10 | Use Windows 10 Professional

Share this Article:

Thanks to all authors for creating a page that has been read 9 times.

Do you have a question not answered in this article?
Click here to ask one of the writers of this article
x

Thank Our Volunteer Authors.

Would you like to give back to the community by fixing a spelling mistake? Yes | No