Is there any way for a laptop running Windows 7 to take a picture using the webcam after entering the wrong user password?


Maybe you might wanna check the KeyLemon login manager. It's the only solution I was able to find that's close to what you need. Works on XP, Vista, 7 and 8. Unfortunately, this feature is present only in the paid version.

From the product page:

Hijackers tracking

With the hijackers tracking feature you can view pictures of:

  • who was in front of your computer before automatic windows lock
  • who typed a wrong password when computer was locked

Disclaimer: I'm in absolutely no way related to the product or company.


What a cool question. Here is my solution (inspired in part by Keltari's answer):


  • A somewhat recent version of Windows (probably Vista or later)
  • A DirectShow-compatible video device (probably anything Windows recognizes as a camera, and more)
  • ffmpeg.exe (http://ffmpeg.org/)

snapshot_login_failure.cmd (place this in some folder with ffmpeg.exe)

@echo off

:: Get date and time independent of regional settings. Source: http://stackoverflow.com/questions/203090/how-to-get-current-datetime-on-windows-command-line-in-a-suitable-format-for-us
for /F "usebackq tokens=1,2 delims==" %%i in (`wmic os get LocalDateTime /VALUE 2^>NUL`) do if '.%%i.'=='.LocalDateTime.' set ldt=%%j
set datetime=%ldt:~0,4%_%ldt:~4,2%_%ldt:~6,2%_%ldt:~8,2%_%ldt:~10,2%_%ldt:~12,2%

:: Capture snapshot through DirectShow using FFmpeg and save to disk. Change name of video adapter and save path.
ffmpeg.exe -f dshow -i video="USB 2.0 UVC HD Webcam" -vframes 1 E:\snapshot_%datetime%.jpg

snapshot_login_failure.xml (import this as a windows scheduler task)

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Security"&gt;&lt;Select Path="Security"&gt;*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4625]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
    <Principal id="Author">
  <Actions Context="Author">


  • You need to adjust device name and paths to fit your system. Perhaps the user accounts in the task file too.
  • You might need to enable logging of failed logins per Windows 7 Logon Failure Events Nonexistent?
  • The login failure event triggers after clicking OK on the "Wrong username or password bla bla" dialog and not immediately after entering invalid login info
  • There is noticable delay if triggered early after the login screen is shown during boot (when Windows is still starting services and the system is IO bound)

Sorry for reviving an old thread, But I'm posting this as help for whoever stumbles on this in the future..

Zero3's Process worked for the most part, and many cudos to him! But, I only got it to work after enabling the logging of failed login attempts, and then right-clicking on the event ID in the logs and selected "attach a task to this event" instead of importing the task via XML, probably something to do with permissions, as I had to type my admin password in to create the task.

Another thing, Which struck me as odd, is that the Task that was triggered didnt recognize the .cmd file as a program/script. to fix this, I made a simple .bat file named run.bat in the same directory with the code below, and instead had the task start the batch file, and thus run the .cmd.

Kind of a hop-Scotch way to get it to work, but I am very pleased with my success thanks to this thread, And I'm tempted to make a video tutorial on this process :)

Many thanks all!

Note: I am running Windows 10 Pro x64

The run.bat code:

Start "" "C:\<filepath to .cmd>"
  • Thanks for your feedback! It would probably be more suitable as comment(s) to my answer, but I guess you might not have enough rep to add comments yet. I will add one for you so that people will notice this!
    – Zero3
    Jun 9 '16 at 8:06

Yes, if you're familiar with windows MSGINA you could in theory create a custom login event which will start the camera on the laptop and snap a picture and save it to a custom folder

Reference: http://technet.microsoft.com/en-gb/library/bb742447.aspx


an invalid login has an logs as Event ID: 529 in the Security event log. You could write a script that monitors for that ID and then execute a command that would take a picture... not sure how to do the second part though...


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.