How To See Who Logged Into a Computer and When

This article shows you How to See who Logged into a Computer and When. Sometimes you would like to monitor who’s logging into your computer and at what time. This can be done if you are not the only person using the computer and if you suspect someone is using your computer. On Professional editions of Windows, one can enable logon auditing to have Windows track which user accounts log in and when.

The Audit logon events setting tracks both local logins and network logins. The logon event specifies the user account that logged on and the time the login took place. At the same time you can see when users logged off.

READ:   How to Fix Error Code 0xc00000e9

NB: The screens might look different depending which version of Windows you are using. You cannot use this if you have a Home edition. The logon auditing is only going to work on the Professional edition of Windows.

How to Enable Logon Auditing on a Computer and When

1.    Open the local group policy editor, press the Windows key + R, type gpedit.msc and press Enter.
2.    Navigate to the following folder: Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy.
How to See who Logged into a Computer
3.    Double-click the Audit logon events policy, in the right pane to adjust its options.
Local Group Policy Editor
4.    Enable the Success checkbox to log successful logons in the properties window. You can also enable the Failure checkbox to log failed logins. Click Apply, then Ok.
Audit Log on events

READ:   How to Install Microsoft Teredo Tunneling Adapter

How to Viewing Logon Events

Once you have enabled these settings, your windows will log logon events which include a username and time to the system security log.

In order to view these events:- Open the Event Viewer
1.    Press the Windows key, on the search programs and files, type Event Viewer, and press Enter to open it.
Events Viewer
2.    Go to Windows Logs > Security category in the event viewer.
3.    Search for events with event ID 4624. This represents successful login events.
How to Viewing Logon Events
4.    Double click it to see more information, such as the user account that logged into the computer
Event Properties
If there are so many details you can click the current Log option in the sidebar and filter by event ID 4624. It will display only logon events
Using the above steps, you will be able to See who Logged into a Computer and When or at what time.