0

How can I track who is logging into my PC?

I thought I could accomplish this by: Audit Setting

However I am wondering if my user policy will work for I am not seeing any log entries. (Other then my user account)

I would like to create some sort of log showing the user and time my PC is remotely accessed. Why? Because someone is logging into my PC and when this occurs my screen will flash for a second.

The frequency of this has been obsessive lately and I would like to provide concrete facts before I send this higher up the food chain. (For example the other day it occurred 8 times within a 30 minute time frame).

3
  • Why can’t you disable all accounts other then your own account? – Ramhound Mar 20 '18 at 21:19
  • How are they logging in? – rakslice Mar 20 '18 at 21:32
  • If they are logging in as a user the Task Manager should show who it is on the Users tab. If they are using some other form of screen mirroring, you might need to dig through the event log around the time it is happening. Why are you so certain someone is logging in though? Screen flashing can be caused by a number of other reasons. – Michael Frank Mar 20 '18 at 21:57
0

Your idea is ok.

Enable Audit logon events in gpedit, make sure you have check all of two options: Success and Failure.

Go to Event Viewer. Windows Logs > Security.

Looking for events with the event ID 4624—these represent successful login events.

Meanwhile, filter Event ID 4625 to see unsuccessful attempts, or event ID 4634 to see when the user logged off.

How to See Who Logged Into a Computer (and When)

https://www.howtogeek.com/124313/how-to-see-who-logged-into-a-computer-and-when/

2
  • I did that today and when I filter on 4624 I see 218 events. – John Doe Apr 3 '18 at 19:58
  • Is there a way to ping these settings? I see that they are getting reset. I believe it happens when PC is RDP into. – John Doe May 22 '18 at 21:20
0

Download Nirsoft's WinLogOnView.

It comes with a nice interface that shows exactly who logged in, how long they were logged in for, and is generally just much easier to use and look at then scraping through event logs for hours.

https://www.nirsoft.net/utils/windows_log_on_times_view.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.