wikiHow is a “wiki,” similar to Wikipedia, which means that many of our articles are co-written by multiple authors. To create this article, volunteer authors worked to edit and improve it over time.
The wikiHow Tech Team also followed the article's instructions and verified that they work.
This article has been viewed 12,314 times.
Learn more...
Setting a password is a good way to secure your computer. However, some people may still try to guess the password to hack your computer. There is no need to fear though, since Windows can log login attempts so that you can see if anybody tried to log into your computer. You do need to do some setup to get it working, but once it's done, you don't have to do it again. This wikiHow will teach you how to set up logging, and how to view the logs once you have set it up.
Steps
Configuring Event Viewer
-
1Open Event Viewer. Press Ctrl+R, type eventvwr into the "Run" box, and then click OK.
-
2Click on "Custom Views".Advertisement
-
3Select "Create Custom View..." in the panel all the way to the right of the window.
-
4Click the drop-down arrow next to the "Event Logs" text-box.
-
5Expand the "Windows Logs" option.
-
6Click the checkbox next to "Security".
-
7Select the text box that has "<All Event IDs>" prefilled. The prefilled text will disappear once you select it.
-
8Type in the appropriate Event ID. You can view 3 different types of events related to logins. You can view Successful logins, login failures, and logoffs. The IDs for each are listed below:[1]
- 4624 - Successful login.
- 4625 - Login Failure.
- 4634 - Logoff.
-
9Click OK.
-
10Name and then type in a description for the Custom View. You should name it something descriptive, and make sure to enter a description of what it is. Then, click OK.
- If you don't want anybody else on the computer to be able to see this custom view, uncheck the "All users" checkbox.
-
11Repeat these steps for each view that you want to create. If you are only interested in reviewing some events, then you can skip creating a new custom view for it.
Reviewing the Logs
-
1Open Event Viewer. Press Ctrl+R, type eventvwr into the "Run" box, and then click OK.
-
2Expand the "Custom Views" folder.
-
3Click on the logs that you want to view. Then, you can review the logs to see if anybody has been trying to hack your computer.
-
4Keep in mind that for successful logins, more than just you logging in will be logged. Logins from system services will also be logged. To tell if it was a human logging in, or a service, look at the "Login Type" value in the details pane. If the login type number is a 2, then it was a human logging in, but if it is any other number, then it was a system service.[2]
References
- ↑ https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
- ↑ https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
- https://www.howtogeek.com/124313/how-to-see-who-logged-into-a-computer-and-when/#:~:text=In%20the%20right-hand%20pane%2C%20double-click%20the%20%E2%80%9CAudit%20logon,attempts.%20Click%20the%20%E2%80%9COK%E2%80%9D%20button%20when%20you%E2%80%99re%20done.
