1

I was following this tut: https://ourtechroom.com/fix/how-to-find-or-check-windows-10-user-login-history/ suggesting that Event Viewer tool might help discover user login history, but when i apply to my machine i find many login events (many ID 4624 events) that are not consistent with my login history on my computer.

How to properly check history of user login on WIndows 11?

THanks

Improve this question
1
  • Successful logons by local users aren't logged by default IIRC. It has to be enabled in the policy editor if regular logons should show up. SYSTEM, User and Network accounts all have different policies.
    – svin83
    Jan 21, 2023 at 11:12

1 Answer 1

Reset to default
2

To enable the audit of logon events :

  • Run the Local Group Policy Editor (gpedit.msc)
  • Position to : Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy
  • Double-click "Audit logon events"
  • Check both "Success" and "Failure"
  • Click Apply
  • Click OK.

After these steps, Windows will track login attempts, both successful or failed.

To check who logged into your computer, in the Event Viewer, section Windows Logs > Security, find all occurrences of event ID 4624.

For more information with screenshots see the article
How to Check Computer Login History on Windows 10/11?

Improve this answer
8

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .