Check window 10 user login history
Do you know we can find out who was login into our windows 10 system when we are away?
When someone logged into the system then there logged information will be stored in the windows 10 system.
In windows 10 there is the "Auditing logon events" policy to track both local and network success and failed login attempts and resources access information. User's attempts to logged-in information can be seen using the event viewer.
Before going to check window 10 user login history, let us learn about Event Viewer.
Event Viewer is especially useful for troubleshooting Windows and application errors.
The categories of events that can be logged are:
- Directory service access
- Account logon events
- Account management
- Privilege use
- Object access
- Logon events
- System events
- Policy change
- Process tracking (source: wikipedia )
Note that :
a) Logon auditing will only work on your Windows Professional, so if you have a home edition of windows, you can't use it.Here, in this article, I am using windows 10 Professional Editions.b) We can't tell you "who" actually logged in the system but can actually tell you at what time and date login is done.
So without wasting time lets check windows 10 user login history step by step:
Step 1 ) Open Event Viewer
Click on the start button and type "Event Viewer" in the search box and you will see Event Viewer at the top of the list. Then click on Event Viewer.
You will get Event Viewer Windows as shown below.
2)Accessing Logging History List
Then on the left pane, double click on "Windows Logs".There you will find 5 lists. Among them just click on "Security", which is in the second position from the top.
3)Finding actual login information ID
Then on the middle pane, you will get the list of events related to user logged and resource access information.This list is sorted by Date/Time.Therefrom top start searching event with Event ID 4624, which is actually user logon event ID.If you find multiple 4624 ID that means your system is logged On many times.
4)Finding Details of login information
Just click on that row (rows having Event ID 4624) you will find login information at the bottom of the same window.
Showing the main information in the general section as below:
Subject: Security ID: SYSTEM Account Name: DESKTOP-9SHPG17$ Account Domain: WORKGROUP Logon ID: 0x3E7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Virtual Account: No Elevated Token: Yes
The user who logged in can find out from Account Name and Account Domain.
Security ID: This is the SID of the account.
Account Name: Logon name of the system.
Account Domain: Domain name of the account. In the case of local accounts, it is just a computer name.
Logon ID: It helps to identify the login session.
Login Type: Login Type shows how user login. There are altogether 9 different types of login. Here, Login Type is 5 which is just a service logon, which occurs when services and service accounts log on to start a service.
Restricted Admin Mode: Here we have "-". We will find "yes" instead of "-" only for login Type: 10 (RemoteInteractive logon) this is when Remote Desktop Connections is made. In our general local system we have "-". Restricted Admin mode is for safeguarding against "pass the hash" attacks.
Importance Event IDs and their purpose
| Event Id | Purpose |
| 4624 | A successful account logon event |
| 4625 | An account failed to log on |
| 4648 | A logon was attempted using explicit credentials |
| 4634 | An account was logged off |
| 4647 | User-initiated logoff |
| 4694 | Special groups have been assigned to a new logon |
| 6005 | Startup event |
Detail Information is shown below:
- System
- Provider
[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}
EventID 4624
Version 2
Level 0
Task 12544
Opcode 0
Keywords 0x8020000000000000
- TimeCreated
[ SystemTime] 2019-12-17T15:45:48.912281500Z
EventRecordID 934340
- Correlation
[ ActivityID] {3b9a6bd1-b09b-0000-846c-9a3b9bb0d501}
- Execution
[ ProcessID] 776
[ ThreadID] 15784
Channel Security
Computer DESKTOP-9SHPG17
Security
- EventData
SubjectUserSid S-1-5-18
SubjectUserName DESKTOP-9SHPG17$
SubjectDomainName WORKGROUP
SubjectLogonId 0x3e7
TargetUserSid S-1-5-18
TargetUserName SYSTEM
TargetDomainName NT AUTHORITY
TargetLogonId 0x3e7
LogonType 5
LogonProcessName Advapi
AuthenticationPackageName Negotiate
WorkstationName -
LogonGuid {00000000-0000-0000-0000-000000000000}
TransmittedServices -
LmPackageName -
KeyLength 0
ProcessId 0x2f4
ProcessName C:\Windows\System32\services.exe
IpAddress -
IpPort -
ImpersonationLevel %%1833
RestrictedAdminMode -
TargetOutboundUserName -
TargetOutboundDomainName -
VirtualAccount %%1843
TargetLinkedLogonId 0x0
ElevatedToken %%1842
Using Custom Filter
As you have seen, Event Viewer keeps large logs records and it is difficult to find particular event ID. But don't worry there is filter features with the help of which we can list only particular Event ID data.
- To create the filter, right-click on "Custom Views" and select the "Create Custom View" option from the list.
- Once Create Custom View windows opens, look at the "Logged" section and pick a time range.
- Then, Check the By log option and Use the down menu of "Event logs" and choose "Security" under "Windows Logs".
- Then, type 4624 in "All Event IDs".
- Click on "Ok".
In the next window, give the name of your custom filter name and click Ok. Here, we have given the name: " ".
- Then in the next screen, look your filtername under "Custom Views".Click on it and you will get your login attempts(Id: 4624 only ) which you have set in earlier steps.
Check Windows 10 User Login History Using Powershell
We can search for a particular event log using Powershell. For this to work you must run PowerShell with admin privilege.
Steps:
- Run Powershell with admin right.
- Then paste below code in PowerShell.
Get-EventLog security | Where-Object {$_.TimeGenerated -gt '2/10/20'} | Where-Object {($_.InstanceID -eq 4634) -or ($_.InstanceID -eq 4624)} | Select-Object Index,TimeGenerated,InstanceID,Message
Check Windows 10 user login history Using Third-party Tools
If you feel irritated doing all those step then you can simply use third-party tools like :
1) TurnedOnTimesView :(Download : click here )
It is a tools that shows Windows 10 / 8 / 7 2008 / Vista logon / Logout times to users.It is developed by Nir Sofer.
2) LastActivityView : (Download:click here )
It is a simple tool for analyzing the operating system log and detecting the time range of the computer is on.It is developed by Nir Sofer.
3)Event Log Explorer: (Download: click here )
Event Log Explorer is a software solution that allows you to view analyze and monitor events that are registered in Microsoft Windows event logs. The Event Log Explorer simplifies and speeds event log review (safety, program, device, installation, directory service, DNS and other) greatly.
4)ADAudit Plus
This software can do active directory auditing, user login /logout auditing, file server auditing. It does enterprise-wide auditing.
5)LepideAuditor (Visit here)
The report details logon and logo-off events including when from what computer and when users are logging in. You get reliable and immediate login details reports of network users as well.