
Use the "Event logs" drop-down menu, and select Security under "Windows Logs.". Use the Logged drop-down menu, select a time range you want. However, you can speed up the process using the Event Viewer filter feature to create a custom view to see only the login attempts. The "Security" page logs many login attempts, including from background services, as such you may need to browse a few events until you find the information you're seeking. In the event log, you'll find a lot of useful information, but you can simply look at the Logged section to figure out when the event took place, and within the "General" tab, look under New Logon to find out the account that was granted permission to your computer. Quick Tip: On Windows 10 Pro, you can also double-click the event with the 4625 ID number to see unsuccessful attempts, or event ID 4634 to see when the user logged off. Search for Event Viewer, click the top result to launch the experience.ĭouble-click the event with the 4624 ID number, which indicates a successful sign-in event. Once you've configured Windows 10 to audit logon events, you can use the Event Viewer to see who signed into your computer and when it happened. 5, make sure to clear the Success and Failure options. If you're no longer interested in tracking logins on your computer, you can use the same instructions, but on step No. On the right side, double-click the Audit logon events policy.Īfter completing the steps, Windows 10 will track every login attempt to your device whether it's successful or not. Type gpedit.msc and click OK to open the Local Group Policy Editor.Ĭomputer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy. Use the Windows key + R keyboard shortcut to open the Run command.
If you're running Windows 10 Home, you can skip these steps, and jump right into the Event Viewer instructions. Important: Group Policy isn't available on Windows 10 Home, but interesting enough, at least login auditing for successful attempts comes enabled by default in this edition. If you're running Windows 10 Pro, you can use the Local Group Policy Editor to enable the "Audit logon events" policy to track success and feature sign-in attempts on your device.
How to enable logon auditing policy on Windows 10
How to enable logon auditing policy on Windows 10.