How to see who logged into your computer

WindowsMacUpdated

On Windows, you can see who logged into your computer in Event Viewer: the Security log records each successful sign-in as event 4624 and each failed one as event 4625, with the account name and time. Lock and unlock events (4800 and 4801) need one extra setting switched on. On a Mac, Apple documents different tools.

Quick answer

Open Event Viewer, go to Windows Logs > Security, choose Filter Current Log and enter 4624,4625. Each event shows the account and the time. Logon Type 2 means someone signed in at the computer, 7 means it was unlocked and 10 means a Remote Desktop sign-in. Lock and unlock events need auditing switched on first.

Where does Windows record sign-ins?

Windows writes sign-ins to the Security log on the computer that was accessed. Microsoft's table of Windows defaults shows that Audit Logon records both successful and failed sign-ins, and says this has been the default since Windows 10 version 1809. Earlier versions recorded only successes by default. You don't need to switch anything on to see 4624 and 4625.

Microsoft describes the events like this:

  • 4624: an account was successfully logged on.
  • 4625: an account failed to log on.
  • 4800: the workstation was locked.
  • 4801: the workstation was unlocked.

How do I see who logged into my computer in Event Viewer?

Filter the Security log for event 4624, then open each entry to read the account name, the time and the Logon Type. You'll see many entries for system accounts and services; the Logon Type tells you which ones were a person signing in.

  1. Search the Start menu for Event Viewer and open it. Use an administrator account.
  2. In the left pane, open Windows Logs and select Security.
  3. On the Action menu, select Filter Current Log.
  4. In Event IDs, type 4624. To include failed attempts, type 4624,4625.
  5. Choose a time period from the Logged list, or Custom range, then select OK.
  6. Open an event. Under New Logon, Account Name is the account that signed in. Under Logon Information, read Logon Type.

The Logon Types that matter most on a home computer, as Microsoft defines them:

  • 2, Interactive: a user logged on to this computer.
  • 5, Service: the Service Control Manager started a service. This is Windows itself, not a person.
  • 7, Unlock: this workstation was unlocked.
  • 10, RemoteInteractive: a user logged on remotely using Terminal Services or Remote Desktop.
  • 11, CachedInteractive: a user logged on with network credentials stored locally on the computer.

To clear the filter afterwards, select Clear Filter on the Action menu.

How do I see failed sign-in attempts?

Failed attempts are event 4625, recorded on the computer where the attempt was made. Each one names the account that was tried and a Status code giving the reason. Microsoft suggests watching especially for several in a row, which can point to someone guessing.

  1. Filter the Security log for 4625, as above.
  2. Open an event and read Account For Which Logon Failed.
  3. Under Failure Information, check Status or Sub Status: - 0xC000006A: a misspelled or bad password. - 0xC0000064: a misspelled or bad account name.

How do I see when my computer was locked and unlocked?

Lock and unlock events, 4800 and 4801, belong to a policy called Audit Other Logon/Logoff Events. Microsoft's table of Windows defaults doesn't list it as switched on for Windows clients, so you will usually need to turn it on before these events appear. Microsoft describes the volume of these events as low.

  1. Open Command Prompt as an administrator.
  2. To check the exact policy names on your computer, run auditpol /list /subcategory:*
  3. Turn on success auditing for the lock and unlock policy: auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable
  4. From then on, filter the Security log for 4800,4801.

Microsoft says these events tell you when a machine was locked or unlocked and which account did it. Events only start from the moment you turn the setting on; earlier locks won't appear.

Can I see who logged into my Mac?

Apple's Mac User Guide doesn't describe a sign-in history screen for home users. What Apple does document are ways to make sure every sign-in needs your password, and a list of devices signed in to your Apple Account. Turning off automatic login matters most: Apple warns it lets anyone access your Mac simply by restarting it.

  1. Choose Apple menu > System Settings > Users & Groups and set "Automatically log in as" to Off.
  2. In System Settings > Lock Screen, set "Require password after screen saver begins or display is turned off".
  3. In System Settings > General > Sharing, turn off Screen Sharing if you don't use it, so other computers can't connect.
  4. In System Settings, click your name and scroll to the devices list to see every device using your Apple Account.

What can't the sign-in log tell you?

The Security log records an account, not a person. If someone knows your Windows password or PIN, their sign-in appears under your name and looks exactly like yours. A 4624 event at 2am tells you your account was used at 2am. It can't tell you whether that was you, a family member or someone else at the keyboard.

If you're worried about someone you live with or a partner, please don't access their devices. In the UK, the National Domestic Abuse Helpline, run by Refuge, is on 0808 2000 247, and you can also contact your local police.

Where Failshot fits

Event Viewer gives you the account and the time. Failshot adds the face. With Failshot on, it photographs whoever unlocks your Mac or Windows computer, and the camera light shows each time it takes a photo. It does not take wrong-password photos at the Windows sign-in screen, so event 4625 is still where failed attempts show.

Someone who knows your password can't switch Failshot off: that needs Touch ID on a Mac where available, or your own Failshot PIN plus your answer. A wrong Failshot PIN takes another photo. Photos stay on your computer, with optional email alerts carrying the photo and the time. When you switch Failshot off yourself, the photo of your own unlock is deleted. It is for your own devices only, and it is out now for Mac, with Windows to follow.

Questions people also ask

Is logon auditing turned on by default in Windows?

Yes, for sign-ins. Microsoft says Audit Logon records success and failure by default from Windows 10 version 1809, so events 4624 and 4625 appear without changes. Lock and unlock events, 4800 and 4801, are in a separate policy that Microsoft's defaults table doesn't show as on.

What is event ID 4624?

Event 4624 means an account successfully logged on. Windows writes it on the computer that was accessed. Open the event to see the account under New Logon, the time, and the Logon Type, which shows whether the sign-in was at the keyboard, an unlock or a Remote Desktop connection.

What is event ID 4625?

Event 4625 means an account failed to log on. It names the account that was tried and gives a Status code. 0xC000006A means a misspelled or bad password; 0xC0000064 means a misspelled or bad account name. Several in a row are worth a closer look.

How can I tell if someone logged into my computer remotely?

Look for event 4624 with Logon Type 10, which Microsoft defines as a sign-in using Terminal Services or Remote Desktop. Microsoft says a computer must run a Pro edition of Windows to accept Remote Desktop connections. You can check the setting in Settings > System > Remote Desktop.

Does the log show who was actually at the computer?

No. It shows which account signed in and when. Anyone who knows your password or PIN signs in as you, so their sign-in looks identical to yours. To know who it was, you need something beyond the log, such as a photo taken at the moment of unlocking.

Sources