In Windows 7, is there a way to know if somebody has logged into my account when I was absent?
Specifically, is it possible to know if a person with administrator privileges somehow entered my account (i.e. in order to get into my email etc.)?
The events will be called Audit Success. The Task Category you will be looking for will be "logon"
Hope this helps!
To anyone: Leave a comment if you don't understand the logs. I'll write a tutorial here =)
You'll have a bunch of system logins; they are normal.
What you will be looking for: Event ID 4624 - Successful logons.
Under the general Tab, Look for NEW ID. Ignore "SYSTEM"
Logs to ignore (unless virus login..)
An indication of a login will look like this: (win 8.1) This will probably be different in win 7
Pathfinder's answer of checking the event log will let you know if someone logged into your computer. However, that will not tell you if they logged into another computer with your account. You would have to check that machine, or a Domain Controller to see logins from other machines.
As for email, thats another story. As an Exchange admin, I can read the mail of anyone in our organization. Honestly, I dont know if that access is logged anywhere. Im sure it would be, but that would be only available to Exchange administrators.
Windows 7 Ultimate connected to a domain, but logging in locally.
I just went through the Security event log and realized that the only time I could find "legitimate" logons were for ID 4648. This worked for me.