What to check if someone logged into your computer? Here is a simple way to set up and check user login history in Windows 10 & 11.
As long as you have the password, logging into the user account in Windows 10 is pretty straightforward. Just type the password and press the Enter button. Though not every day, there might be situations where you need to know the exact time when a user is logged into the computer. i.e., check Windows 10 user login history. For example, maybe you want to enforce strict usage timing for the family PC, monitor unauthorized access, troubleshoot a specific login access problem, etc.
The good thing is, by enabling a simple group policy, we can easily track all user login events in Windows 10. If you don’t know, most system administrators and organizations use this same trick to keep track of all user logins to their systems.
So, let me show you how to check user login history in Windows 10 and 11 operating systems without delay.
Note: Though the steps are demonstrated in Windows 10, they will also work in Windows 11.
Important note: Since we are using the Group Policy Editor, you need to be using Pro or Enterprise edition. If you are using the Home edition, you cannot track user login events. Steps to check Windows version.
Turn on user login tracking in Windows 10 & 11
To check user login history in Windows, you first need to enable the user login tracking using the “Auditing Logon Events” policy. You can do that from the Group Policy Editor. Here is how to do it.
As the first thing, we need to open the Group Policy Editor. Search for “Edit Group Policy” in the Start menu or use the “gpedit.msc” in the Run dialog box to open it.
The group policy editor is where you can find and configure different policies in Windows 10 and 11. Policies are categorized and stored in separate folders. So, go to the following folder. This is where you will find the policy we are looking for.
Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy
In the Audit Policy folder, find and double-click on the “Auditing Logon Events” policy. As you can tell from the name itself, this policy is responsible for tracking and logging user logins in Windows 10.
Now, we want to log all user login activities. So, select the “Success” and “Failure” checkboxes. Click the “Apply” and “Ok” buttons.
After setting up the policy, close the Group Policy Editor and reboot the computer. After rebooting, Windows will log all user login activities in the Event Viewer.
Check user login history in Windows 10 & 11
As long as the “Auditing Logon Events” policy is active, Windows will log all successful and failed login attempts in the Event Viewer. As such, you can open the Event Logger to check Windows user login history. Here is how.
First, open the Event Viewer tool. You can either search for “Event Viewer” in the Start menu or use the “eventvwr” Run command.
After opening the Event Viewer tool, we can filter out the events using the Event ID. Since each type of event has a specific ID, it is easy to filter out successful and failed login attempts.
Go to the “Event Viewer > Windows Logs > Security” folder on the left panel in the Event Viewer. On the right panel, find the event with the “4624” ID. This event ID indicates a successful login. Event ID “4625” denotes an unsuccessful login. You can see when this event occurred in the “Date and Time” column.
A quick tip: Click on the “Event ID” or “Date and Time” column heading to arrange them in ascending or descending order. This makes it easy to find the Event ID and see when it occurred.
Double-click on the event itself to see which user logged in at that time. You will see the username right next to the “Account Name” heading. If you have multiple user accounts, this is very helpful.
So, by looking at the event ID and when it occurred, you can tell when a user is logged in.
That is all. It is that simple to check user login history and see if someone logged into your computer.
I hope that helps.
If you need help, comment below. I will do my best.