How-To

Check Successful or Failed Windows Login Attempts

By Hammad Saleem

Updated June 29, 2021

Here’s how to check our Windows Logon Logs in Event Viewer to find out if someone has been trying to access your Windows computer.

Have you ever checked your Windows system logs to see if anyone has tried to access your computer? Even if you have multiple users, keeping track of who’s accessing your computer is important. You might want to make sure your ex-girlfriend or someone else isn’t trying to log in to your computer. Here’s to check Audit Logs in Windows to see who’s tried to get in.

Open Event Viewer in Windows

In Windows 7, click the Start Menu and type: event viewer in the search field to open it.

For Windows 8, you can open Event Viewer from the Power User Menu from the Desktop.

Expand Windows Logs and click on Security.

Now, look for event ID 4624; these are successful login events for your computer.

Double-clicking on the event will open a popup with detailed information about that activity. It will show you complete details about that specific login, including the account name, date, and login time.

Enable Logon Auditing

If you don’t see these events in your Event Viewer, you might have to enable Login Auditing. It may be enabled for your computer to save successful logs but if it’s not, here’s how you can do it.

Note: Group Policy Editor is not available in Home versions on Windows 7 or the standard version of Windows 8.

In Windows 7, open the Start Menu and type: gpedit.msc

Or in Windows 8, use the keyboard shortcut Windows Key + R and type: gpedit.msc in the Run line and hit Enter.

In Group Policy Editor, navigate to Windows Settings >> Security Settings >> Local Policy >> Audit Policy.

Then double click on Audit Logon Events.

From there, check the boxes to audit successful or failed audit attempts and click OK.

There you go! Now you’ll be able to see the complete logon activities (failed or successful) for your Windows computer.