When managing multiple users, it’s common to want to check who is logging in when or if there are any failed login attempts. For example, maybe you want to enforce strict login times, monitor unauthorized usage, troubleshoot specific login problems, etc. Whatever the reason, you can easily check the user login history in Windows 11 and Windows 10 using the Event Viewer. The good thing is that the Event Viewer lists all the successful and failed logins with separate Event IDs so that you can keep track of them easily.
In this quick and easy tutorial, let me show you the set up process of enabling login tracking in Windows and checking the user login history using Event Viewer. Let’s get started.
Before You Begin
- Before following the steps below, make sure login tracking is enabled on your computer. If not, follow the link and enable it first.
- The steps below have been tested to work on Windows 11 and Windows 10.
Steps to Check User Login History in Windows 11 & Windows 10
- Press the Start button on your keyboard.
- Search and open “Event Viewer“.
- Go to the “Windows Logs” > “Security” folder.
- Click the “Filter current log” option on the right sidebar.
- Type the below ID in the “All Event IDs” field and click “OK“.
- For successful login attempts: 4624
- For failed login attempts: 4625
- Click the “Date and Time” column to sort the list from newer to older.
- Double-click on the event item in the list to open it.
- You will see the details of the user in the “General” tab.
- Close the Event Viewer when done.
- With that, you now know the simplest way to check user login history.
Detailed Steps (With Screenshots)
First, open the Event Viewer tool. You can either search for “Event Viewer” in the Start menu, use the “eventvwr” Run command, or right-click on the Start button and select the “Event Viewer” option.
After opening the Event Viewer tool, go to the “Windows Logs” > “Security” folder. Here, click the “Filter current logs” option on the right sidebar.
In the filter options window, go to the “XML” tab and select the “Enter query manually” checkbox at the bottom. Click “Yes” in the confirmation window.
Now, replace the existing XML with the following XML and click the “OK” button. For example, since we want to track successful login attempts, enter the first XML.
- For successful login attempts:
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[System[(EventID=4624)]]
and
*[EventData[Data[@Name='LogonType']='2']]
</Select>
</Query>
</QueryList>
- For failed login attempts:
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[System[(EventID=4625)]]
and
*[EventData[Data[@Name='LogonType']='2']]
</Select>
</Query>
</QueryList>
Note: If you don’t want to use the XML, simply type “4624” or “4625” for successful and failed login attempts respectively in the “All Event IDs” field in the “Filter” tab and click “OK“. The disadvantage is that along with users, services, and processes are also logged in with the same event ID. So, you have to manually open each event to find the user login entry.
The above action will filter and list all the events with the given “Event ID”. You can sort the list from newer to older by clicking the “Date and Time” column heading.
Double-clicking on the event item shows you detailed login history such as the user name, computer name, etc.
Wrapping Up — Check User Login History in Windows
As you can see, thanks to the Event Viewer, you can check when a user logs in and if there are any failed login attempts. Keep in mind that to be able to track, you first need to enable login tracking in Windows. Also, even after filtering the events by their ID and logon type, you will still see a lot of logon events of processes and services. In that case, simply go through each event till you find the one you are looking for.
If you have any questions or need help, comment below. I’ll be happy to help.
