How to Event Log Login and Shutdown Activities in Windows 10

In Windows, you can track all logins and shutdowns with Event Viewer. If you have multiple users using your system and want to know which user logged in and logged off when then follow the below steps to log shutdown and login activities to event viewer in Windows 10.

Windows has some incredible tools that when used properly, will give you a lot of control and information. Event Viewer is one such tool.

In case you don’t know, Windows logs almost every event that happens in your system. You can see all those logs in the Event Viewer. However, some events like login and log off are only logged to the Event Viewer after specifically enabling the policies. Once you start logging the login and shutdown activities, you can easily know when someone logged into your PC by checking the log times.

So, without further ado, let me show how you can log login and log off events to event viewer.

Log Shutdown and Login Activities to Event Viewer

Like I said before, you need to enable a simple policy in the Group Policy Editor. The good thing about the policy is that it will log all successful and failed login or log off activities. So, in theory, you can even tell if someone tried and failed to log into your PC.

1. Open Group Policy Editor by searching for “Edit Group Policy” and clicking on the result. You can also search for “gpedit.msc” too.

Log login and shutdown activities - open group policy

2. All the policies are divided into several different folders. You can see those folders on the left panel. Go to the following folder on the left panel.

Computer Configuration → Windows Settings → Security Settings → Local Policies → Audit Policy

3. On the right panel, find and double-click on the “Audit logon events” policy.

Log login and shutdown activities - open policy

4. In the policy properties window, select both “Success” and “Failure” checkboxes and click on the “Apply” and “Ok” buttons to save changes. Selecting both the checkboxes will allow you to log both successful and failed logon events.

Log login and shutdown activities - select both checkboxes

5. To apply the changes, reboot Windows.

After rebooting, Windows will log all login and shutdown activities to the Event Viewer.

View Login and Shutdown Logs

Now, once you’ve enabled the logs, it’s only natural that you want to see those logs as and when needed. The good thing is Windows logs both shutdown and login events with their event ID. Which means that you can easily find those events.

1. To see the login and log off events, open Event Viewer by searching for it in the start menu.

Log login and shutdown activities - open event viewer

2. In the Event Viewer, go to “Event Viewer → Windows Logs → Security” appearing on the left panel.

3. To find the login or shutdown events, look for the event ID’s 4624 and 4634 respectively. All the IDs are listed under the Event ID section in the middle panel.

Log login and shutdown activities - logged items

4. Sometimes, it can be quite hard to find the event you are looking for. This is especially true if you have a ton of events. In those situations, you can use the built-in Filter functionality. To filter events, click on the “Filter Current Log” option appearing on the right panel.

Log login and shutdown activities - select filter option

5. In the filter window, select “Last Hour” from the Logged drop-down menu, enter the Event ID (4624 for login events, 4634 for log off events) in the field above Task Category and click on the “Ok” button.

A quick tip: You can separate event IDs with , to view multiple events. For example, to see both login and log off events, enter “4624, 4634” in the Event ID field.

Log login and shutdown activities - fill filter options

6. The above action will show the filter the results and show only the events of your interest.

That is it. It is that simple to log login and shutdown activities and know when someone logins into your computer.

Leave a Comment

Scroll to Top