How to View a Computer's Log On History?

The Event Viewer on Windows 7 and 8 stores records of almost every system process that occurs on a computer, including user logins and wakes from sleep mode. By default, Event Viewer displays an enormous list of data, making it hard to find specific information, but by using grouping you can track down a machine's login history. This process works both for checking the activity of a single user and for checking the times that each of several users logged in.

Woman Sits On Tree Trunk In Forest Using Laptop Computer
credit: monkeybusinessimages/iStock/Getty Images

Step

Press "Windows-R" and run the command "eventvwr." (Ed.: The Run window doesn't care about extraneous quotes or even if the reader accidentally leaves in the sentence's period, so no need to specify "without quotes," etc.) On Windows 8 systems, you can alternatively press "Windows-X," choose "Computer Management" and double-click "Event Viewer" as a shortcut.

Step

Double-click "Windows Logs" on the left-hand panel to open the folder, and then select the "Security" section. When you first open a section in Event Viewer, the program might lock up for a couple minutes while it loads logs. Wait until the log list appears in the top center panel.

Step

Click the "Date and Time" column header if you want to view the login history from from oldest to newest. If you don't click the header, the logs automatically sort from newest to oldest.

Step

Right-click on the "Task Category" column header and choose "Group Events by This Column" to split each type of log into a separate group for easier searching. Wait until the log list flickers or shifts positions, indicating Event Viewer has finished grouping, and then scroll to the very top of the list.

Step

Click the up arrow on the first line in the panel, which displays the first group's name, to hide the group. Continue hiding group after group until you reach the group labeled "Task Category: Logon."

Step

Select the first entry in the Logon group to view its information. Read the line labeled "Account Name" to see which account logged in at the time listed in the Date and Time column. Any logs with "Audit Failure" in the Keywords column indicate a failed login attempt.

Step

Use the up and down arrows to browse through the rest of the logs. When you finish, quit Event Viewer. You don't need to save anything before quitting, but Event Viewer won't remember your groupings or position when you open it again.