How to tell if someone used your laptop

WindowsMacUpdated

To tell if someone used your laptop, look at what it remembers: recently opened files and apps, browser history, and the sign-in activity on your Microsoft, Apple or Google account. On Windows you can also read the Security log in Event Viewer. None of these shows a face, but together they show what happened and when.

Quick answer

On Windows, open File Explorer Home for recently used files and check your browser history. On a Mac, choose Apple menu > Recent Items and check Safari's history. Then check your account activity: account.live.com/Activity for Microsoft, the Devices list for your Apple Account, and Your devices in your Google Account.

How do I see recently opened files on Windows?

File Explorer keeps a list of what you have opened lately. Microsoft says your frequently used folders and recently used files are listed in Quick access, which Windows 11 version 22H2 renamed File Explorer Home. Look for files you don't remember opening, or times when you weren't at the laptop.

  1. Press Windows logo key + E to open File Explorer.
  2. Select Home (Quick access on older versions).
  3. Read the list of recent files and note the dates.

Home can also show your recent Office.com files, so a document opened on another of your devices may appear here too. If the list is empty, recent files may have been switched off in the View tab's Options.

How do I see recently opened files and apps on a Mac?

macOS keeps a short list of recent documents, apps and servers in the Apple menu, and the Dock can show recent apps. If an app or file appears that you didn't open, someone else may have.

  1. Choose Apple menu > Recent Items.
  2. Look through the Applications and Documents sections.
  3. Check the Recent apps section of the Dock, if it is turned on.

Can browser history show if someone used my laptop?

Yes, often. Browser history lists the sites visited and when. Look for sites you don't recognise or visits at times you were away. A gap proves less: Chrome doesn't store pages visited in Incognito mode, so someone browsing privately leaves nothing in the history.

  1. In Chrome, select More at the top right, then History, then History.
  2. In Safari on a Mac, choose History > Show All History and use the Search field at the top right.

Safari can keep your history the same across all your devices through iCloud, so an entry may have come from your own iPhone. Microsoft Edge also keeps a viewable history on each device and across synced devices.

Can I see when my Windows laptop was signed in to?

Yes. Windows records sign-ins in the Security log, which you can read in Event Viewer. Event 4624 means an account successfully signed in, and 4625 means a sign-in failed. Microsoft says that from Windows 10 version 1809, both are recorded by default. Our guide on how to see who logged into your computer walks through it step by step.

  1. Open Event Viewer and go to Windows Logs > Security.
  2. On the Action menu, choose Filter Current Log.
  3. In Event IDs, type 4624,4625 and pick a time range under Logged.
  4. Open an event and read the account name and the time.

The log shows which account signed in, not who was sitting there. If someone knows your password, the entry will look like you.

How do I check sign-ins to my Microsoft, Apple or Google account?

Your accounts keep their own records. Microsoft's Recent activity page shows when and where your Microsoft account was used in the last 30 days. Apple and Google each list the devices signed in to your account. An unfamiliar device or location is worth acting on.

  1. Microsoft: go to account.live.com/Activity. If an entry sits under Unusual activity and it wasn't you, choose This wasn't me, which starts a password change.
  2. Apple on a Mac: choose Apple menu > System Settings, click your name and scroll to the devices list. On the web, sign in at account.apple.com and select Devices.
  3. Google: open your Google Account, go to the security section and choose Manage all devices under Your devices.

Google notes that times show the last contact with Google, so they can be more recent than your last real use.

Can someone use my laptop remotely?

Remote access needs a sharing feature switched on. On Windows, Microsoft says the computer you connect to must run a Pro edition to accept Remote Desktop connections, and a remote sign-in shows in the Security log as Logon Type 10. On a Mac, Screen Sharing is set in System Settings > General > Sharing.

  1. Windows: go to Start > Settings > System > Remote Desktop and check whether it is on.
  2. Mac: choose Apple menu > System Settings > General > Sharing and turn off Screen Sharing if you don't use it.

What should I change if I think someone used it?

Make the laptop harder to open next time. On a Mac, Apple warns that automatic login allows anyone to access your Mac simply by restarting it, so turn it off and require a password when the screen saver starts. Then change the passwords on any account the person could have reached.

  1. Mac: System Settings > Users & Groups, set "Automatically log in as" to Off.
  2. Mac: System Settings > Lock Screen, set "Require password after screen saver begins or display is turned off".
  3. Change your Microsoft, Apple or Google password, and remove devices you don't recognise.

If your worry is about a partner or someone you live with, please don't go through their devices. In the UK you can talk to the National Domestic Abuse Helpline, run by Refuge, on 0808 2000 247, or contact your local police.

Where Failshot fits

Everything above tells you what happened after the fact. Failshot answers who. With Failshot on, it photographs whoever unlocks your Mac or Windows laptop, and the camera light shows each time it takes a photo. It does not take wrong-password photos at the Windows sign-in screen.

Someone who knows your password still can't switch it off: that needs Touch ID on a Mac where available, or your own Failshot PIN plus your answer, and a wrong Failshot PIN takes another photo. Photos stay on your device, with optional email alerts that send the photo and the time. When you switch Failshot off yourself, the photo of your own unlock is deleted. Failshot is for your own devices only. It is out now for Mac, with Windows to follow.

Questions people also ask

How can I tell if someone used my computer while I was away?

Compare what your laptop remembers with when you were out. Check File Explorer Home or Apple menu > Recent Items, then your browser history, then your account activity. On Windows, the Security log in Event Viewer lists successful and failed sign-ins with times.

Does private browsing leave any history?

Chrome doesn't store pages visited in Incognito mode in its history. So an empty history doesn't prove nobody used the laptop. Recent files, the Windows Security log and your account sign-in pages are separate records worth checking as well.

Can I see who logged into my laptop on Windows?

You can see which account signed in and when. Open Event Viewer, go to Windows Logs > Security and filter for event 4624 (successful sign-in) and 4625 (failed sign-in). It shows the account, not the person, so someone using your password will appear as you.

How do I know if someone is using my laptop remotely?

Check whether remote access is switched on. On Windows Pro, look at Settings > System > Remote Desktop; remote sign-ins appear in the Security log as Logon Type 10. On a Mac, check Screen Sharing in System Settings > General > Sharing.

What should I do if I find activity I don't recognise?

Change the password for the affected account and remove devices you don't recognise. On Microsoft's Recent activity page, choosing This wasn't me starts a password change. On a Mac, turn off automatic login and require a password after the screen saver starts.

Sources