How to Check Successful or Failed Login Attempts on Your Windows Computer – MUO – MakeUseOf
Do you suspect someone is trying to sneak into your Windows computer account? Here’s how to set up a tracker for login attempts.
Windows lets you create multiple user accounts to let multiple users use a single computer. But what if you suspect someone to have accessed your PC or user account without your knowledge?
While physically monitoring your computer all the time is not feasible for most people, the built-in Windows log utility, Event Viewer, can reveal the recent activities on your computer, including login attempts. Here we show you how to audit failed and successful login attempts in Windows using Event Viewer and other methods.
You need to enable logon auditing in Group Policy Editor to be able to view login audit in Event Viewer. While this feature may be enabled by default on some computers, you can also enable logon auditing manually by following these steps.
Note that Group Policy Editor is only available on the Pro, Edu, and Enterprise edition of the Windows OS. If you are on the Home edition, follow our guide to enable gpedit in the Windows home edition.
Note that if you don't configure your Group Policy for Logon Auditing, you can only view the successful login attempts in Event Viewer.
Once you have the Group Policy Editor enabled, follow these steps to enable logon auditing:
Close Group Policy Editor and move to the next set of steps to view login attempts in Event Viewer.
The Event Viewer lets you view Windows logs for the application, security, system, and other events. While a useful application to troubleshoot system issues, you can use it to audit login events on your Windows PC.
Follow these steps to view failed and successful login attempts in Windows:
While Event ID 4624 is associated with logon events, you will likely find multiple instances of this entry occurring every few minutes in the log. This is due to Event Viewer recording every logon event (whether from the local user account or system services such as Windows Security) with the same event ID (Event 4624).
To identify the source of login, right-click on the event record and select Properties. In the General tab, scroll down and locate the Logon information section. Here, the Logon Type field indicates the kind of logon that occurred.
For example, Logon Type 5 indicates a service-based login, while Logon Type 2 indicates user-based login. Know more about the different logon types in the table below.
Next, scroll down to the New Logon section and locate the Security ID. This will show the user account that was affected by the logon.
Similarly, for failed login attempts, review Event ID 4625. In the Properties dialog, you can find reasons for the failed login attempt and the affected user account. If you find multiple instances of unsuccessful attempts, consider learning how to limit the number of failed login attempts to protect your Windows PC.
Below is the list of all nine Logon Types for logon events that you may encounter reviewing login events in Event Viewer:
You can use the Command Prompt to view the last login attempt. It is a handy way to find user-based login attempts without having to go through all the logon events in Event Viewer.
To view the login history of a specific user using Command Prompt:
If you suspect someone to have logged in to your PC, the Event Viewer will likely catch and record the attempt. For this to work, you must enable the Logon Auditing policy in Group Policy Editor. You can also use Command Prompt to view a specific user's login history.
That said, anyone who knows their way around Event Viewer can easily clear the logs. So, if anything, beefing up your Windows computer security is the best way to prevent unauthorized access. You can begin by limiting the number of failed login attempts on your Windows PC.
Tashreef is a developer and works as a technical writer at MakeUseOf. With a bachelor’s degree in Computer Applications, he has over 5 years of experience and covers Microsoft Windows and everything around it. When not looking for a missing semicolon or churning out text, you can find him trying FPS titles or looking for new animated shows and movies.