Here’s how to check our Windows Logon Logs in Event Viewer to find out if someone has been trying to access your Windows computer.
Have you ever checked your Windows system logs to see if anyone has tried to access your computer? Even if you have multiple users, keeping track of who’s accessing your computer is important. You might want to make sure your ex-girlfriend or someone else isn’t trying to log in to your computer. Here’s to check Audit Logs in Windows to see who’s tried to get in.
Open Event Viewer in Windows
In Windows 7, click the Start Menu and type: event viewer in the search field to open it.
Expand Windows Logs and click on Security.
Now, look for event ID 4624, these are successful login events for your computer.
Double clicking on the event will open a popup with detailed information about that activity. It will show you complete details about that specific login including the account name, date and time of login.
Enable Logon Auditing
If you don’t see these events in your Event Viewer, you might have to enable Logon Auditing. It may be enabled for your computer to save successful logs but if it’s not, here’s how you can do it.
Note: Group Policy Editor is not available in Home versions on Windows 7 or the standard version of Windows 8.
In Windows 7 open the Start Menu and type: gpedit.msc
Or in Windows 8, use the keyboard shortcut Windows Key + R and type: gpedit.msc in the Run line and hit Enter.
In Group Policy Editor, navigate to Windows Settings >> Security Settings >> Local Policy >> Audit Policy.
Then double click on Audit Logon Events.
From there, check the boxes to audit successful or failed audit attempts and click OK.
There you go! Now you’ll be able to see the complete logon activities (failed or successful) for your Windows computer.