When a user logs into your computer, their information gets stored and one can easily their details. In this post, we will be talking about how to check the User Login History in Windows 11/10 or Windows Server.
Check User Login History in Windows 11/10
The following are the steps to check User Login History in Windows 11/10.
- Open Event Viewer
- Go to Login History
- Look for User Login
- Get their Details.
Let us talk about them in detail.
How to know if someone is logging in to your Windows PC
1] Open Event Viewer
There are a lot of ways by which you can open the Event Viewer. You can either search it out from the Start Menu or hit Win + R to open Run, type “eventvwr.msc” and click Ok.
Related: How to view and delete Event Viewer Saved Error Logs in Windows
2] Go to Login History
After launching Even Viewer, you need to expand, Windows Logs and click Security to go to the Login History.
3] Look for User Login
You will see a list of different events sorted by Date/Time. But you need to look for Event ID 4624, which actually is the Event ID for User Login. If you are seeing multiple Event ID 4624, then this means that there are multiple logins.
4] Get their Detail
To get their detail, you need to select a particular of which you want to know the details. Now, click Details and you will see the information about the User login.
Hopefully, you are able to extract all the information you need about User login.
How to apply Filter to boil down User Login Details?
If you feel there are lots of redundant information and you want to apply a filter to just get information about Event ID 4625, you need to follow the given information.
- In Even Viewer, right-click on Custom View, and select Create Custom View.
- Check By Log and select Security from the drop-down menu.
- Replace <All Event IDs> with 4624.
- Click Ok.
- You may be asked to give it a name, do that and click Ok.
Now, you can see filtered information.
How to enable Logon Auditing Policy to keep a track of User Login History
Most of the time this policy is enabled by default but there are some users who have complained about not being able to see the User Login History because of the policy being turned off. The issue is persistent in the Pro version of Windows 11 and 10 and hence, requires you to enable the policy manually.
To do that, open Group Policy Editor from the Start Menu and navigate to the following location.
Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy
Double-click on Audit logon events and tick both Success and Failure from the Local Security Setting tab. And click Ok.
After doing this restart your computer and you will be able to keep a track of User Login History.
Read Next:
