Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In Windows 7, is there a way to know if somebody has logged into my account when I was absent?

Specifically, is it possible to know if a person with administrator privileges somehow entered my account (i.e. in order to get into my email etc.)?

share|improve this question
2  
Why would I need to login? I'd just pull your hard drive out, plug it into mine, and copy your email/files/super secret stuff without ever logging into your PC. –  Grant Mar 10 at 18:29

2 Answers 2

up vote 19 down vote accepted

Recommended Method:

  1. Press Windows button + R and type eventvwr.msc.

  2. In event viewer, Expand Windows Logs, and select Security.

  3. In the middle you’ll see a list with Date and Time, Source, Event ID and Task Category. The Task Category pretty much explains the event, Logon, Special Logon, Logoff and other details.

The events will be called Audit Success. The Task Category you will be looking for will be "logon"

Hope this helps!

To anyone: Leave a comment if you don't understand the logs. I'll write a tutorial here =)

You'll have a bunch of system logins; they are normal.

What you will be looking for: Event ID 4624 - Successful logons.

Under the general Tab, Look for NEW ID. Ignore "SYSTEM"

Logs to ignore (unless virus login..)

New Logon:
Security ID:        SYSTEM
Account Name:       SYSTEM
Account Domain:     NT AUTHORITY
Logon ID:       0x3E7
Logon GUID:     {00000000-0000-0000-0000-000000000000}

An indication of a login will look like this: (win 8.1) This will probably be different in win 7

New Logon:
Security ID:        WORK\Superuser
Account Name:       Superuser@micrsoft.com
Account Domain:     MicrosoftAccount
Logon ID:       0x12345678
Logon GUID:     {00000000-0000-0000-0000-000000000000}
share|improve this answer
    
Thanks! I actually see 4 events for each successful logon (by myself): "Logon - 4624", "Special Logon - 4672", "Logon - 4648", "Logon - 4624", all at the same time. –  Erel Segal Halevi Mar 10 at 10:53

Pathfinder's answer of checking the event log will let you know if someone logged into your computer. However, that will not tell you if they logged into another computer with your account. You would have to check that machine, or a Domain Controller to see logins from other machines.

As for email, thats another story. As an Exchange admin, I can read the mail of anyone in our organization. Honestly, I dont know if that access is logged anywhere. Im sure it would be, but that would be only available to Exchange administrators.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.