How to Track Login Attempts in Windows 10
On Windows 10, you can track login attempts, which can come in handy in many scenarios, including to find out who has been using your device without permission.
When the "Auditing logon events" policy is enabled, Windows 10 can track local, and network logins whether they're successful or not, and every event will include the account name and the time of when it happened among other information.
If you're running Windows 10 Pro, you can use the Local Group Policy Editor to enable the "Audit logon events" policy to track success and feature sign-in attempts on your device.
1. Press Windows + R keys to open Run box.
2. Type gpedit.msc and click OK button to open the Local Group Policy Editor.
3. Browse the following path:
4. On the right side, double-click the Audit logon events policy.
5. Place a check mark for Success and Failure options.
6. Click Apply and OK buttons.
You can use the Event Viewer to see who signed into your computer and when it happened.
1. Type Event Viewer, into Start Menu search box and press Enter key.
2. Browse the following path:
3. Double-click the event with the 4624 ID number, which indicates a successful sign-in event.
When the "Auditing logon events" policy is enabled, Windows 10 can track local, and network logins whether they're successful or not, and every event will include the account name and the time of when it happened among other information.
If you're running Windows 10 Pro, you can use the Local Group Policy Editor to enable the "Audit logon events" policy to track success and feature sign-in attempts on your device.
Information
Group Policy isn't available on Windows 10 Home, but interesting enough, at least login auditing for successful attempts comes enabled by default in this edition. If you're running Windows 10 Home, you can skip these steps, and jump right into the Event Viewer instructions.
1. Press Windows + R keys to open Run box.
2. Type gpedit.msc and click OK button to open the Local Group Policy Editor.
3. Browse the following path:
Code:
Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy4. On the right side, double-click the Audit logon events policy.
5. Place a check mark for Success and Failure options.
6. Click Apply and OK buttons.
You can use the Event Viewer to see who signed into your computer and when it happened.
1. Type Event Viewer, into Start Menu search box and press Enter key.
2. Browse the following path:
Code:
Event Viewer > Windows Logs > Security3. Double-click the event with the 4624 ID number, which indicates a successful sign-in event.
Tip
On Windows 10 Pro, you can also double-click the event with the 4625 ID number to see unsuccessful attempts, or event ID 4634 to see when the user logged off.