How to view user login activity on Windows

Monitoring user login events in Windows is essential for maintaining system security and auditing. Precise tracking of successful and failed logins helps detect unauthorized access, troubleshoot configuration issues, and verify compliance with organizational policies. Built-in tools capture and organize this data, providing administrators with comprehensive records of user authentication.

Event Viewer is a native Windows utility that collects and displays security events, including user logins. By filtering for specific Event IDs, administrators quickly identify relevant activity and investigate who accessed the system, when access occurred, and any potential login failures. This approach streamlines the analysis of authentication attempts to maintain a secure environment.

PowerShell scripting and third-party logging solutions offer additional options, but Event Viewer remains a preferred choice due to its ease of use and native integration. It provides detailed information without extra setup, allowing administrators to review user session logs from a centralized interface and preserve a reliable security audit trail.

1. Open Event Viewer by pressing Windows + R, typing eventvwr.msc, and pressing Enter.
2. Expand Windows Logs in the left panel.

   Security logs contain the most relevant data on user login events.

3. Click on Security to access security-related log entries.
4. Right-click on Security and choose Filter Current Log from the context menu.
5. Enter 4624 for successful logins and 4625 for failed logins under the Event IDs field.

   4624: Successful logon event
   4625: Failed logon attempt

   Event IDs serve as unique filters for different types of security events.

6. Click OK to apply the filter and display relevant login events.
7. Review the listed entries to examine timestamps, user accounts, and other security details.

   Filtering by usernames or specific time ranges refines results for targeted investigations.

8. Double-click any entry to see additional information, including the logon type and source.
9. Refer to this example log output for reference.

   Log Name: Security
   Source: Microsoft-Windows-Security-Auditing
   Date: 10/19/2024 12:34:56 PM
   Event ID: 4624
   Task Category: Logon
   Level: Information
   Keywords: Audit Success
   User: N/A
   Description:
   A logon was successfully performed.
   Logon Type: 2 (Interactive)
   User Name: ExampleUser
   Domain: EXAMPLE
   Source Network Address: 192.168.1.10

10. Export filtered logs from the Actions pane to retain a copy for advanced analysis or reporting.

    If no events appear, verify that appropriate audit policies are enabled via Group Policy.