Windows makes it easy to check who logged into a computer and when thanks to a feature called logon auditing.
It tracks local and network logon events, and also shows which user account has logged on and at what time. Furthermore, logon auditing also monitors and displays logoff events.
How to check who logged into a computer and when
Before we get started with the guide you should know logon auditing is a Windows Professional feature and it’s not available on Windows Home editions. Nevertheless, if you have Windows Professional 7, 8 or 10, you can use logon auditing and the process is very similar for all of these versions.
The first thing you need to do, is open the Local Group Policy Editor (you’ll need it to enable logon auditing). Click the Start button, type “gpedit” and select the entry called “Edit group policy”.
In the Local Group Policy Editor window, use the tree view explorer in the left pane to navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy. Double-click the “Audit logon events” setting in the right pane.
A properties window will open. There, enable the “Success” option to make Windows log all successful logon attempts. If you want Windows to also log failed logon attempts then enable the “Failure” option as well. Hit OK to save the changes and close the properties window then exit the Local Group Policy Editor.
From now on, Windows will record the selected logon events, and each will also have a username and a timestamp. To view them, we will use the Event Viewer.
Click the Start button, type “event” and select the result called “Event Viewer”.
Use the left pane in the Event Viewer window to go to Windows Logs -> Security.
The list in the middle will populate in a few seconds. The Audit Success events that interest us are the ones that have the “Logon” task type and the event ID 4624 – these are the successful login events.
To view more details about a selected event, check the bottom of the middle pane or double-click it to open them in a separate window.
There, you can view all the information about that logon event, including the user account name.
