How to see who logged into my computer (as local admin)

How can I track who is logging into my PC?

I thought I could accomplish this by: Audit Setting

However I am wondering if my user policy will work for I am not seeing any log entries. (Other then my user account)

I would like to create some sort of log showing the user and time my PC is remotely accessed. Why? Because someone is logging into my PC and when this occurs my screen will flash for a second.

The frequency of this has been obsessive lately and I would like to provide concrete facts before I send this higher up the food chain. (For example the other day it occurred 8 times within a 30 minute time frame).

PrivateJoker

Posted 2018-03-20T20:29:15.460

Reputation: 1

Why can’t you disable all accounts other then your own account? – Ramhound – 2018-03-20T21:19:33.260

How are they logging in? – rakslice – 2018-03-20T21:32:00.647

If they are logging in as a user the Task Manager should show who it is on the Users tab. If they are using some other form of screen mirroring, you might need to dig through the event log around the time it is happening. Why are you so certain someone is logging in though? Screen flashing can be caused by a number of other reasons. – Michael Frank – 2018-03-20T21:57:28.277

Answers

Your idea is ok.

Enable Audit logon events in gpedit, make sure you have check all of two options: Success and Failure.

Go to Event Viewer. Windows Logs > Security.

Looking for events with the event ID 4624—these represent successful login events.

Meanwhile, filter Event ID 4625 to see unsuccessful attempts, or event ID 4634 to see when the user logged off.

How to See Who Logged Into a Computer (and When)

https://www.howtogeek.com/124313/how-to-see-who-logged-into-a-computer-and-when/

Origami

Posted 2018-03-20T20:29:15.460

Reputation: 1 309

I did that today and when I filter on 4624 I see 218 events. – John Doe – 2018-04-03T19:58:45.973

Is there a way to ping these settings? I see that they are getting reset. I believe it happens when PC is RDP into. – John Doe – 2018-05-22T21:20:23.077

Download Nirsoft's WinLogOnView.

It comes with a nice interface that shows exactly who logged in, how long they were logged in for, and is generally just much easier to use and look at then scraping through event logs for hours.

https://www.nirsoft.net/utils/windows_log_on_times_view.html

Panomosh

Posted 2018-03-20T20:29:15.460

Reputation: 192