How to View a Computer's Log On History?
The Event Viewer on Windows 7 and 8 stores records of almost every system process that occurs on a computer, including user logins and wakes from sleep mode. By default, Event Viewer displays an enormous list of data, making it hard to find specific information, but you can use grouping to track a machine's login history. This process works both for checking the activity of a single user and for checking the times that each of several users logged in.
Press "Windows-R" and run the command "eventvwr." On Windows 8 systems, you can alternatively press "Windows-X," choose "Computer Management" and double-click "Event Viewer" as a shortcut.
Double-click "Windows Logs" on the left panel to open the folder, and then select the "Security" section. When you first open a section in Event Viewer, the program might lock up for a couple minutes while it loads. Wait until the log list appears in the top center panel.
Click the "Date and Time" column header if you want to view the login history from from oldest to newest. If you don't click the header, the logs automatically sort from newest to oldest.
Right-click the "Task Category" column header and choose "Group Events by This Column" to split each type of log into a separate group for easier searching. Wait until the log list flickers or shifts positions, indicating Event Viewer has finished grouping, and then scroll to the top of the list.
Hide the group by clicking the up arrow on the first line in the panel, which displays the first group's name. Continue hiding group after group until you reach the group labeled "Task Category: Logon."
Select the first entry in the Logon group to view its information. Read the line labeled "Account Name" to see which account logged in at the time listed in the Date and Time column. Any logs with "Audit Failure" in the Keywords column indicate a failed login attempt.
Browse the logs using the up and down arrows. When you finish, quit Event Viewer. You don't need to save anything before quitting, but Event Viewer won't remember your groupings or position when you open it again.
Tips & Warnings
- Logs in the Security section won't identify times when a user wakes a computer from sleep without having to log in afterwards. To find the times a computer woke up, open the "System" section in Event Viewer, group events by the Source column and look at the events in the group labeled "Source: Power-Troubleshooter."
- Grouping and sorting events can take a minute or two if you have several months or years of logs saved on the computer. If nothing seems to happen after you group or sort, wait a few minutes for the machine to catch up.
- To export specific events to a portable file, hold "Ctrl" and click the events to select them. Open the "Action" menu and choose "Save Selected Events" on Windows 8 or "Save Events As" on Windows 7.
- Information in this article applies to Windows 7, 8 and 8.1. It may vary slightly or significantly with other versions.