Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a log in Windows 7 that tells me what user accounts logged into a computer? If not, is there a way to find out another way?

share|improve this question
1  
I just saw this on my way out! I can't quickly write up a good answer but will if no one else has by the time I get back. Depending on your edition of Windows 7, you may be able to enable user logging from local security policy. Also for a more "spy" answer, take a look here superuser.com/questions/311569/… –  William Hilsum Sep 2 '11 at 20:57
    
possible duplicate of Windows 7 Logon Failure Events Nonexistent? –  Shinrai Sep 2 '11 at 21:06
    
Just to clarify - the wording of the question may seem different at first but it's essentially the same question. You need to enable logging for this, and then you can find it in Event Viewer. –  Shinrai Sep 2 '11 at 21:06
    
@Shinrai it's not an exact duplicate - this question asks how to log access, that one asks why the events aren't showing up. There's a difference. –  nhinkle Sep 2 '11 at 21:17

2 Answers 2

up vote 5 down vote accepted

You can do this using the Event Log. You may have to configure Login Auditing first though.

Login events are recorded in the Security log. To view them, open the event viewer (just type Event viewer into the start menu search bar, or run eventvwr in the run dialog). Then, open the Security log and look for logon events.

If you don't see any logon events recorded in the security log, you need to configure login auditing. Open the Local Security Policy configuration tool (also avaialable by searching from the start menu). Go to Local Policies > Audit Policy, and turn on Audit account logon events and Audit logon events. You won't see old logs, but all future logins will be recorded.

share|improve this answer
    
Pro or higher required for Gpedit to be available. –  Moab Sep 2 '11 at 21:53
    
@moab that's correct. Home editions should already have auditing turned on though. –  nhinkle Sep 2 '11 at 22:25

You can check the user by looking at Event Viewer/Security. Just search for Event Viewer application in the Start menu and inside this application, choose Security. You will find a list of events where you can search for the logon or logoff events.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.