How to Check Windows Login History

Want to find out who logged into your Windows system and when? This information can be useful for both administrators and regular users to monitor activity and detect any unauthorized access attempts. Here are several ways to view login history in Windows.

1. Using Windows Event Viewer

The Windows Event Viewer provides detailed information about login activities. Follow these steps:

  1. Press Win + R and type eventvwr.msc, then press Enter.
  2. In the Event Viewer, go to Windows Logs → Security.
  3. Look for events with the ID 4624 (successful login) and 4625 (failed login attempt).

You can use the filter feature to make searching easier. Click on Filter Current Log and enter the event ID (e.g., 4624).

2. Using Command Prompt (cmd)

If you prefer using the Command Prompt, you can try this command:

wevtutil qe Security /rd:true /c:10 /f:text /q:"*[System[(EventID=4624)]]"

This command displays the last 10 successful login events. You can change the /c:10 parameter to view more entries.

3. Using PowerShell

PowerShell can also be used to view detailed login information:

Get-EventLog -LogName Security | Where-Object {$_.EventID -eq 4624} | Select-Object TimeGenerated, Message

This command shows the time and message of each successful login.

4. Viewing Login History via "Local Users and Groups"

To check login history through "Local Users and Groups," follow these steps:

  1. Press Win + R and type lusrmgr.msc, then press Enter.
  2. Go to Users and select the desired user account.
  3. In the user properties window, you can view the account's login history.

5. Using Third-Party Tools

There are also third-party tools that make viewing login logs easier, such as LastActivityView by NirSoft. This lightweight tool displays the activity history on your computer, including login times.