How to see Who logged into a computer and When was it?

Has it ever struck your mind to check who has logged into your computer and when did they do it? Well on Professional versions of Windows, the logon auditing can be enabled to have Windows track which user accounts get logged in and when.

The Audit logon events setting tracks both local logins and network logins. Each logon event specifies the user account that logged on and the time the login took place. You can also see when users logged off.

Note: Logon Auditing works only with Professional versions so you cannot use it on a Home version of Windows 7,8,8.1,10.

Enable Logon Editing

To enable logon auditing, you'll be using the Local Group Policy Editor which is a pretty powerful tool, so if you’ve never used it before, it’s worth taking some time to learn what it can do. Also, if you’re on a company network, do check with your admin first. If your work computer is part of a domain, it’s also likely that it’s part of a domain group policy that will supersede the local group policy, anyway.

To open the Local Group Policy Editor, hit Start, type gpedit.msc and then select the resulting entry.

In the Local Group Policy Editor, in the left-hand pane, drill down to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy. In the right-hand pane, double-click the Audit logon events setting.

In the properties window that opens, enable the Success option to have Windows log successful logon attempts. You can also enable the Failure option if you want Windows to log failed logon attempts. Click OK once you’re done.

Now you can close the Local Group Policy Editor Window.

View Logon Events

After you enable logon auditing, Windows records those logon events—along with a username and timestamp—to the Security log. You can view these events using Event Viewer.

Hit Start, type Event, and then click the Event Viewer result.

In the Event Viewer window, in the left-hand pane, navigate to Windows Logs > Security.

In the middle pane, you’ll most likely see a number of Audit Success events. Windows logs separate details for things like when an account someone signs on with is successfully granted its privileges. You should be looking for events with the event ID 4624—these represent successful login events. You can see details about a selected event in the bottom part of that middle-pane, but you can also double-click an event see its details in their own window.

And if you scroll down just a bit on the details, you can see information you're after- like the user account name.

And because this is just another event in the Windows event log with a specific event ID, you can also use the Task Scheduler to take action when a logon occurs. You can even have Windows email you when someone logs on.