FacebookTwitterLinkedIn

How to Know Who Logged into Windows 10?

How to Know if Someone Logged Into Your Windows 10?

Windows 10 lets you see which users are logged into your PC using Event Viewer (and when they logged in). This article is dedicated to Windows Home Edition users interested in Windows auditing.

event viewer

Event viewer is a Windows component that enables administrators and regular users to view event logs on a local or remote machine. It uses event IDs to define uniquely identifiable events that a Windows computer might encounter.

Event Viewer displays a log of application and system information messages, including warnings and errors (these are displayed even if your system is running correctly).

This feature is helpful if you are troubleshooting a specific problem and require more information about the cause. You can look for events in different categories such as "Application," "System," and "Security." Here, we will focus on the "Security" category of Event Viewer.

NOTE: If you run Windows 10 Home, you will only see successful login attempts (this log is enabled by default in this edition). You have to use Windows Pro edition with the included Local Group Policy Editor to allow full login auditing.

Video Showing How to See Who Logged Into Your Windows 10:

Table of Contents:

How to See Who Logged Into Windows 10 Using Event Viewer 

First, open Event Viewer by typing "event viewer" in Search and click the "Event Viewer" result.

how to see who logged into your windows using event viewer step 1

In the Event Viewer, expand the "Windows Logs" category and select "Security." You will see a list of events. Events with ID number 4624 indicate successful sign-ins.

how to see who logged into your windows using event viewer step 2

Double click an event with this ID number (4264) to see details. If you are using Windows 10 Pro, you will also see events with ID 4625 (unsuccessful attempts) and 4634 (user log-off) - double-click these to see details. 

In the "Logged" section, you can see when someone is logged into your PC (including you). In the "General" tab, look for "New Logon," and you will see the account that is logged in.

how to see who logged into your windows using event viewer step 3

[Back to Table of Contents]

How to Set a Custom Filter In Event Viewer

As mentioned, Event Viewer keeps many logs with a great deal of information, so it may be not easy to find a particular event ID (there could be hundreds of events logged throughout the day). A filter feature in the Event Viewer enables you to create a custom view to see only particular event IDs. We use a filter to see only the IDs of logged events pertaining to login attempts in this example. Right-click on "Custom Views" and select the "Create Custom View..." option to create this filter.

how to set an id filter event viewer step 1

In the Create Custom View window, look for the "Logged" section and select a time range.

how to set an id filter event viewer step 2

Then choose to view "By log" and select "Security" from the "Windows Logs" drop-down menu.

how to set an id filter event viewer step 3

In the Event ID field, type the ID number '4624' and click OK.

how to set an id filter event viewer step 4

Name your Custom View filter and click OK.

how to set an id filter event viewer step 5

Your Custom View filter is now created, and you can see all events logged that match your criteria. Double click the event to see details.

how to set an id filter event viewer step 6

You will now be able to find out who and when users successfully logged in to your PC. This guide works on earlier versions of Windows, such as Windows 7 & 8.1. Hope this helped!

[Back to Top]

▼ Show Discussion

About the author:

Rimvydas Iliavicius

Rimvydas is a researcher with over four years of experience in the cybersecurity industry. He attended Kaunas University of Technology and graduated with a Master's degree in Translation and Localization of Technical texts. His interests in computers and technology led him to become a versatile author in the IT industry. At PCrisk, he's responsible for writing in-depth how-to articles for Microsoft Windows. Contact Rimvydas Iliavicius.

Our guides are free. However, if you want to support us you can send us a donation.

About PCrisk

PCrisk is a cyber security portal, informing Internet users about the latest digital threats. Our content is provided by security experts and professional malware researchers. Read more about us.

Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.