How To Find Who Logged Into Your Computer And When

Believe it or not, you are surrounded by snoopy and curious people. You might have come across the feeling that someone used your computer without permission, but can’t point a finger on anyone. It can be anyone, your best friend, your annoying roommate or your inquisitive sibling.

Well, to assure the privacy and check if your suspicion is correct, you can always check who meddled with your machine.

Now you might think, I have password protected computer, no one can login on it. Think again, there are many other ways, people could log into your device and do malicious activity or send uncouth messages or e-mail from your ID. Moreover, you could also keep a check on what your kids or younger siblings do on the computer.

Here, in this article we will discuss about the methods by which you could find out, who has logged into your computer and when.

Find out the Unauthorized Logins in your system

You can check, who used the system without your permission by checking a few things

• Event Viewer
• Recent Files Accessed
• Checking the Browsing History on your Browser
• The Final Recourse: Scheduled Task

Event Viewer:

Before checking Event Viewer, you need to make sure that you have enabled Audit Logon. If not, follow these steps to do so –

• Click on Start button and type gpedit.msc to open Local Group Policy Editor.

Once it is open Navigate: Local Computer Policy –> Computer Configuration –> Windows Settings –> Security Settings –> Local Policies –> Audit Policy.

.           A List of Policies would open, right click on “Audit logon events”. Select Properties.

• Now enable the Success and Failure checkbox to know all the logins.

Enabling this feature will now record the logon events. In future, you could be able to check all the logon activities. In case, you have already enabled Audit Logon, skip these steps.

• Now click on a Start Button on Desktop, type Event Viewer in Search box.

• Navigate to Windows Logs –> Security category in the event viewer.
• Double Click on Security and check the login and logout events.

• To know more about the event – such as the user account used to log into the computer. Double-click the event and scroll down in the text box.

Well, checking windows logs can be cumbersome and if, you are lucky you will stumble upon the evidence whether someone is messing with your machine or not.

Recent Files Accessed

You can catch the snoopy one, by checking the recent activities or modification of files done on the computer. It is one of the quickest way, all you need to do is –

Click on Start Button and check for Recent Items.

In case, you don’t see it, you need to enable it, follow these steps to do the same.

• Right Click on Start Button, click on Properties.
• Taskbar and Start Menu Properties will be displayed.
• Click on Customize. Now you will see the list of items that can be displayed on Start Menu, select Recent Items and click on ok.

This might help you find the culprit, but if the person is tech savvy, he must have erased the recent items list to cover the tracks.

Then, you should check for the recently modified files.

• To Open Window Explorer, press Windows and E key.
• Click on the Drive, whichever contains files and click in the search field and select “Date modified”.

• Choose a date, you’ll get a list of all files that were modified on the date.

Checking the Browsing History on your Browser

You can take a quick glance at the browsing history to know, if there had been any websites visited recently.

With this, you can check the browser activity and even come to know more about the snoopy person. All you need to do is check the browsing history of the browser installed.

The Final Recourse: Scheduled Task

If you can’t find any action performed and still have suspicion that someone has used your computer, you can treat this as a last option. Set a Scheduled Task that will send you a notification, whenever the system will come out of sleep mode or someone tries to access your machine.

To schedule the task –

Click on Start button and type Schedule, select Task Scheduler.

• Click on Action-> Create Task

• Under General Tab – > Click on the checkbox to select “Run whether user is logged on or not”

• Now click on Triggers Tab -> New -> Begin the task -> Change the status from “On a Schedule” to “At startup” or “On workstation unlock”.

• You can also customize, if nothing on the list suits you. Select “On an event” and and then select which application or system event you want to use to trigger the notification to alert you when someone is using your computer.

• To find specific applications rather than just system events, you’ll need to select “Application” from the list, and then choose the application from the “Source” list.

These are a few methods to keep in check the system’s activity and in case you have found that someone is using your system, it is advised to change your username and password to ensure the further security. Also, scan the system to make sure there aren’t any malicious files on the system.