Who accessed my computer in Windows 7?

Is there a log in Windows 7 that tells me what user accounts logged into a computer? If not, is there a way to find out another way?

MacGyver

Posted 2011-09-02T20:52:56.557

Reputation: 892

I just saw this on my way out! I can't quickly write up a good answer but will if no one else has by the time I get back. Depending on your edition of Windows 7, you may be able to enable user logging from local security policy. Also for a more "spy" answer, take a look here http://superuser.com/questions/311569/take-a-webcam-photo-on-login-using-windows-7/330042#330042

– William Hilsum – 2011-09-02T20:57:22.687

possible duplicate of Windows 7 Logon Failure Events Nonexistent?

– Shinrai – 2011-09-02T21:06:13.073

Just to clarify - the wording of the question may seem different at first but it's essentially the same question. You need to enable logging for this, and then you can find it in Event Viewer. – Shinrai – 2011-09-02T21:06:59.377

@Shinrai it's not an exact duplicate - this question asks how to log access, that one asks why the events aren't showing up. There's a difference. – nhinkle – 2011-09-02T21:17:24.233

Answers

You can do this using the Event Log. You may have to configure Login Auditing first though.

Login events are recorded in the Security log. To view them, open the event viewer (just type Event viewer into the start menu search bar, or run eventvwr in the run dialog). Then, open the Security log and look for logon events.

If you don't see any logon events recorded in the security log, you need to configure login auditing. Open the Local Security Policy configuration tool (also avaialable by searching from the start menu). Go to Local Policies > Audit Policy, and turn on Audit account logon events and Audit logon events. You won't see old logs, but all future logins will be recorded.

nhinkle

Posted 2011-09-02T20:52:56.557

Reputation: 35 057

Pro or higher required for Gpedit to be available. – Moab – 2011-09-02T21:53:29.080

@moab that's correct. Home editions should already have auditing turned on though. – nhinkle – 2011-09-02T22:25:09.667

You can check the user by looking at Event Viewer/Security. Just search for Event Viewer application in the Start menu and inside this application, choose Security. You will find a list of events where you can search for the logon or logoff events.

Marlos

Posted 2011-09-02T20:52:56.557

Reputation: 121