See Who Has Logged Into Windows 10

Edited by Jay

NorthernTouch check-login-attempts-Windows-10-000.png

If you're the system administrator in your household, and you share a PC with multiple people, you may want to monitor who's been logging in from time-to-time. With the Logon Auditing Policy enabled, you can see who's been using your device, along with any attempts users have made to log in. In addition to checking local accounts, you can also see network sign-in attempts as well. You'll be able to view both successful and failed login attempts, along with the name of the account, the time they tried to sign-in, plus some other information too.

Was this helpful? Yes | No| I need help

So if you suspect your roommate or sibling has been trying to hack into your device, you'll be able to see a record of all the attempts, and better yet, be able to prove it! Although this feature is typically reserved for professional environments, it still has some practical use for home users as well.

Was this helpful? Yes | No| I need help

In the following VisiHow guide, we'll go through the steps for enabling the logon audit policy, and also how to use the event viewer to check on who's been logging in. For this article, we used a Sager laptop running Windows 10 Professional.

Was this helpful? Yes | No| I need help

**Please Note** Editing the group policy isn't available for Windows 10 Home users. However, successful login auditing comes turned on by default. So if you're using Windows 10 Home edition, you can jump directly to the section on using the Event Viewer.

Was this helpful? Yes | No| I need help

Enable Audit Account Logon Events Via Group Policy in Windows 10

NorthernTouch check-login-attempts-Windows-10-00-group-policy.png
  1. 1
    Using your keyboard, press the Windows key + R at the same time.
    NorthernTouch check-login-attempts-Windows-10-01.png
    Advertisement
    Was this step helpful? Yes | No| I need help
  2. 2
    When the Run command window appears, type; "gpedit.msc" (without the quotes), then click "OK".
    NorthernTouch check-login-attempts-Windows-10-02.png
    Advertisement
    Was this step helpful? Yes | No| I need help
  3. 3
    From the Local Group Policy Editor window, double-click "Computer Configuration".
    NorthernTouch check-login-attempts-Windows-10-03.png
    Was this step helpful? Yes | No| I need help
  4. 4
    Under the Computer Configuration section, double-click "Windows Settings".
    NorthernTouch check-login-attempts-Windows-10-04.png
    Was this step helpful? Yes | No| I need help
  5. 5
    In the Windows Settings section, double-click "Security Settings".
    NorthernTouch check-login-attempts-Windows-10-05.png
    Was this step helpful? Yes | No| I need help
  6. 6
    Under Security Settings, double-click the "Local Policies" folder.
    NorthernTouch check-login-attempts-Windows-10-06.png
    Was this step helpful? Yes | No| I need help
  7. 7
    From Local Policies, double-click "Audit Policy".
    NorthernTouch check-login-attempts-Windows-10-07.png
    Was this step helpful? Yes | No| I need help
  8. 8
    Under Policy, double-click "Audit account logon events".
    NorthernTouch check-login-attempts-Windows-10-08.png
    Was this step helpful? Yes | No| I need help
  9. 9
    In the Account logon event window, place a checkmark next to; "Success" and "Failure" in the Audit these attempts section, then click "Apply".
    NorthernTouch check-login-attempts-Windows-10-09.png
    Was this step helpful? Yes | No| I need help
  10. 10
    Next, click "OK" to close the Audit properties window.
    NorthernTouch check-login-attempts-Windows-10-10.png
    With the above steps completed, Windows will now track all login attempts on your machine, whether they were successful or not.
    Was this step helpful? Yes | No| I need help

Use Event Viewer to Check Login Attempts in Windows 10

NorthernTouch check-login-attempts-Windows-10-00-event-viewer.png
  1. 1
    Using the taskbar search function, type "event viewer" (without the quotation marks). When the results return, click the first option at the top.
    NorthernTouch check-login-attempts-Windows-10-11.png
    Advertisement
    Was this step helpful? Yes | No| I need help
  2. 2
    In the Event Viewer window, double-click "Windows Logs".
    NorthernTouch check-login-attempts-Windows-10-12.png
    Was this step helpful? Yes | No| I need help
  3. 3
    In the Windows Logs section, double-click "Security".
    NorthernTouch check-login-attempts-Windows-10-13.png
    Was this step helpful? Yes | No| I need help
  4. 4
    Here in the Security section, you'll see all the logon attempts. Double-click the log that displays the Event ID 4624.
    NorthernTouch check-login-attempts-Windows-10-14.png
    Was this step helpful? Yes | No| I need help
  5. 5
    In the top section of the event properties window, you'll see the account name of the person who signed-in. Also, below in the Logged section, you'll see the time and date this user signed-in.
    NorthernTouch check-login-attempts-Windows-10-15.png
    If when you're back in the Security section, you see Event 4740, this indicates that a user was locked out for entering the wrong password too many times.
    Was this step helpful? Yes | No| I need help
  6. 6
    You can also create a custom view to access certain logged events much quicker. Right-click "Custom Views", then click "Create Custom View".
    NorthernTouch check-login-attempts-Windows-10-16.png
    Was this step helpful? Yes | No| I need help
  7. 7
    In the Create Custom View window, select "By Log". Then, using the drop-down arrow in the Logged section, select a time range.
    NorthernTouch check-login-attempts-Windows-10-17.png
    Was this step helpful? Yes | No| I need help
  8. 8
    While still in the Create Custom View window, expand the drop-down next to "Event Logs:", then select "Security".
    NorthernTouch check-login-attempts-Windows-10-18.png
    Was this step helpful? Yes | No| I need help
  9. 9
    Finally, while still in the Create Custom View window, enter the event ID "4624" (without the quotes), then click "OK".
    NorthernTouch check-login-attempts-Windows-10-19.png
    Was this step helpful? Yes | No| I need help
  10. 10
    Next, enter a name for your custom view, then click "OK".
    NorthernTouch check-login-attempts-Windows-10-20.png
    Now you'll be able to pull the logs on all sign-in attempts much faster.
    Was this step helpful? Yes | No| I need help

If you have problems with any of the steps in this article, please ask a question for more help, or post in the comments section below.

Comments

VisiHow welcomes all comments. If you do not want to be anonymous, register or log in. It is free.

Article Info

Categories : Use Windows 10 | Use Windows 10 Professional

Share this Article:

Thanks to all authors for creating a page that has been read 9 times.

x

Thank Our Volunteer Authors.

Would you like to give back to the community by fixing a spelling mistake? Yes | No