Check User Login History in Windows 11/10
The following are the steps to check User Login History in Windows 11/10. Let us talk about them in detail.
How to know if someone is logging in to your Windows PC
1] Open Event Viewer
There are a lot of ways by which you can open the Event Viewer. You can either search it out from the Start Menu or hit Win + R to open Run, type “eventvwr.msc” and click Ok.
2] Go to Login History
After launching Even Viewer, you need to expand, Windows Logs and click Security to go to the Login History.
3] Look for User Login
You will see a list of different events sorted by Date/Time. But you need to look for Event ID 4624, which actually is the Event ID for User Login. If you are seeing multiple Event ID 4624, then this means that there are multiple logins.
4] Get their Detail
To get their detail, you need to select a particular of which you want to know the details. Now, click Details and you will see the information about the User login. Hopefully, you are able to extract all the information you need about User login.
How to apply Filter to boil down User Login Details?
If you feel there are lots of redundant information and you want to apply a filter to just get information about Event ID 4625, you need to follow the given information. Now, you can see filtered information.
How to enable Logon Auditing Policy to keep a track of User Login History
Most of the time this policy is enabled by default but there are some users who have complained about not being able to see the User Login History because of the policy being turned off. The issue is persistent in the Pro version of Windows 11 and 10 and hence, requires you to enable the policy manually. To do that, open Group Policy Editor from the Start Menu and navigate to the following location. Double-click on Audit logon events and tick both Success and Failure from the Local Security Setting tab. And click Ok. After doing this restart your computer and you will be able to keep a track of User Login History. Read Next:
How to clear the Event Log in WindowsUse Event Viewer to check unauthorized use of a computer.
