How to Know Who Logged into Windows 10?
Written by Rimvydas Iliavicius on
How to Know if Someone Logged Into Your Windows 10?
Windows 10 lets you see which users are logged into your PC using Event Viewer (and when they logged in). This article is dedicated to Windows Home Edition users interested in Windows auditing.
Event viewer is a Windows component that enables administrators and regular users to view event logs on a local or remote machine. It uses event IDs to define uniquely identifiable events that a Windows computer might encounter.
Event Viewer displays a log of application and system information messages, including warnings and errors (these are displayed even if your system is running correctly).
This feature is helpful if you are troubleshooting a specific problem and require more information about the cause. You can look for events in different categories such as "Application," "System," and "Security." Here, we will focus on the "Security" category of Event Viewer.
NOTE: If you run Windows 10 Home, you will only see successful login attempts (this log is enabled by default in this edition). You have to use Windows Pro edition with the included Local Group Policy Editor to allow full login auditing.
Video Showing How to See Who Logged Into Your Windows 10:
Table of Contents:
- Introduction
- How to See Who Logged Into Windows 10 Using Event Viewer
- How to Set a Custom Filter In Event Viewer
- Video Showing How to See Who Logged Into Your Windows 10
How to See Who Logged Into Windows 10 Using Event Viewer
First, open Event Viewer by typing "event viewer" in Search and click the "Event Viewer" result.
In the Event Viewer, expand the "Windows Logs" category and select "Security." You will see a list of events. Events with ID number 4624 indicate successful sign-ins.
Double click an event with this ID number (4264) to see details. If you are using Windows 10 Pro, you will also see events with ID 4625 (unsuccessful attempts) and 4634 (user log-off) - double-click these to see details.
In the "Logged" section, you can see when someone is logged into your PC (including you). In the "General" tab, look for "New Logon," and you will see the account that is logged in.
How to Set a Custom Filter In Event Viewer
As mentioned, Event Viewer keeps many logs with a great deal of information, so it may be not easy to find a particular event ID (there could be hundreds of events logged throughout the day). A filter feature in the Event Viewer enables you to create a custom view to see only particular event IDs. We use a filter to see only the IDs of logged events pertaining to login attempts in this example. Right-click on "Custom Views" and select the "Create Custom View..." option to create this filter.
In the Create Custom View window, look for the "Logged" section and select a time range.
Then choose to view "By log" and select "Security" from the "Windows Logs" drop-down menu.
In the Event ID field, type the ID number '4624' and click OK.
Name your Custom View filter and click OK.
Your Custom View filter is now created, and you can see all events logged that match your criteria. Double click the event to see details.
You will now be able to find out who and when users successfully logged in to your PC. This guide works on earlier versions of Windows, such as Windows 7 & 8.1. Hope this helped!
▼ Show Discussion