How To Know If Someone Logged Into Your Windows 10?
Windows 10 enables you to see which users are logged into your PC using Event Viewer (and when they logged in). Event viewer is a component of Microsoft Windows that enables administrators and regular users to view event logs on a local or remote machine. It uses event IDs to define uniquely-identifiable events that a Windows computer might encounter. Event Viewer displays a log of application and system information messages, including warnings and errors (these are displayed even if your system is running correctly).
This feature is helpful if you are troubleshooting a specific problem and require more information about the cause. You can look for events in different categories such as "Application", "System" and "Security". In the Application event log, you can find events relating to Windows system components such as drivers and built-in interface elements. The System event log provides event logs relating to programs installed on your Windows operating system. The Security event log also provides events relating to security such as login attempts and resource access. In this article, we discuss the Security category in more detail, since it enables you to see who and when users logged into your computer.
NOTE: If you are running Windows 10 Home, you will only be able to see successful login attempts (this log is enabled by default in this edition). To enable full login auditing, you must use Windows Pro edition with the Local Group Policy Editor included. This article is only useful for Home edition users specifically interested in Windows auditing for successful attempts.
Table of Contents:
- How To See Who Logged Into Windows 10 Using Event Viewer
- How To Set Custom Filter In Event Viewer
- Video Showing How To See Who Logged Into Your Windows 10
How To See Who Logged Into Windows 10 Using Event Viewer
First, open Event Viewer by typing "event viewer" in Search and clicking the "Event Viewer" result.
In the Event Viewer, expand the "Windows Logs" category and select "Security". You will see a list of events. Events with ID number 4624 indicate successful sign-ins.
Double click an event with this ID number (4264) to see details. If you are using Windows 10 Pro, you will also see events with ID 4625 (unsuccessful attempts) and 4634 (user log-off) - double-click these to see details.
In the "Logged" section, you can see when someone is logged into your PC (including you). In the "General" tab, look for "New Logon", and you will see the account that is logged in.
How To Set A Custom Filter In Event Viewer
As mentioned, Event Viewer keeps many logs with a great deal of information, so it may be not easy to find a particular event ID (there could be hundreds of events logged throughout the day). There is a filter feature in the Event Viewer enabling you to create a custom view to see only particular event IDs. In this example, we filter use a filter to see only the IDs of logged events pertaining to login attempts. To create this filter, right-click on "Custom Views" and select the "Create Custom View..." option.
In the Create Custom View window, look for the "Logged" section and select a time range.
Then choose to view "By log" and select "Security" from the "Windows Logs" drop-down menu.
In the Event ID field, type the ID number '4624' and click OK.
Name your Custom View filter and click OK.
Your Custom View filter is now created and you can see all events logged that match your criteria. Double click the event to see details.
You will now be able to find out who and when users successfully logged in to your PC. This guide works on earlier versions of Windows such as Windows 7 & 8.1. Hope this helped!
Video Showing How To See Who Logged Into Your Windows 10: