How to Know Who Logged On to Your Windows 8 PC in Your Absence

Ashish Mundhra

doorIf you have a shared computer at your home which is used by your kids or siblings too, there might have been times when you wanted to keep a check on who is accessing the computer (and when).

The Pro version of Windows 8 comes with a built-in feature using which you can easily record Windows logon events along with the user information and the time at which the computer was accessed. This was available in Windows 7 too, although not in all the versions.

We will be seeing how we can audit logon events in Windows 8 Pro but you can trace the exact same steps to enable the feature in Windows 7 Professional and Ultimate versions.

Recording the Events

Step 1: The first thing we will need to do is activate the logon event audit using Windows Group Policy Manager. Press Windows+R to open Run box, type in gpedit.msc and press enter.

Run gpedit

Step 2: After the Windows Group Policy editor opens up, navigate to Local Computer Policy –> Computer Configuration –> Windows Settings –> Security Settings –> Local Policies –> Audit Policy. Here look for the policy audit logon events and double click on it.

local gropu policy editor

Step 3: When the logon event property window opens up, check the success and the failure option to audit those attempts. Finally click on the Apply button and save the settings.

audit logon

From now on, Windows will log every logon event along with some basic details.

Let’s have a look at how we can view logon events for the purpose of reviewing them.

Viewing the events

Step 1: When you want to have a look at the logon events, press the shortcut Windows+W and search for the view events. The search result will return only one possible match –  View events log. Open it.

view event log

Step 2: In the Event log viewer, navigate to Windows Logs –> Security category and look for all the events with event ID 4624. This is the event ID for all the events that correspond to successful logon event. Double click on it to view details like username, logon date and time, etc.

event 4624

event details

So that was how you can record and view logon events in Windows 8 Pro. You might have to sort the event IDs to easily view all the logon events.

Conclusion

The process is a bit geeky and requires you to do some out of the box things that a normal Windows user does not come across in regular usage of his PC. However, if you are keen enough to keep track of all the logon events on your computer, this is how it’s done. Hope that helps.

Also See
#monitoring #windows 7

Join the newsletter

Ashish Mundhra

Written By

Ashish Mundhra

Ashish is a staff writer and video editor at Guiding Tech. He loves all things tech and has a soft corner for Android. Apart from contributing articles here, he also takes care of our YouTube Channel.