0

How can I track who is logging into my PC?

I thought I could accomplish this by: Audit Setting

However I am wondering if my user policy will work for I am not seeing any log entries. (Other then my user account)

I would like to create some sort of log showing the user and time my PC is remotely accessed. Why? Because someone is logging into my PC and when this occurs my screen will flash for a second.

The frequency of this has been obsessive lately and I would like to provide concrete facts before I send this higher up the food chain. (For example the other day it occurred 8 times within a 30 minute time frame).

Improve this question
3
  • Why can’t you disable all accounts other then your own account?
    – Ramhound
    Commented Mar 20, 2018 at 21:19
  • How are they logging in?
    – rakslice
    Commented Mar 20, 2018 at 21:32
  • If they are logging in as a user the Task Manager should show who it is on the Users tab. If they are using some other form of screen mirroring, you might need to dig through the event log around the time it is happening. Why are you so certain someone is logging in though? Screen flashing can be caused by a number of other reasons.
    – Michael Frank
    Commented Mar 20, 2018 at 21:57

2 Answers 2

Reset to default
0

Your idea is ok.

Enable Audit logon events in gpedit, make sure you have check all of two options: Success and Failure.

Go to Event Viewer. Windows Logs > Security.

Looking for events with the event ID 4624—these represent successful login events.

Meanwhile, filter Event ID 4625 to see unsuccessful attempts, or event ID 4634 to see when the user logged off.

How to See Who Logged Into a Computer (and When)

https://www.howtogeek.com/124313/how-to-see-who-logged-into-a-computer-and-when/

Improve this answer
2
  • I did that today and when I filter on 4624 I see 218 events.
    – John Doe
    Commented Apr 3, 2018 at 19:58
  • Is there a way to ping these settings? I see that they are getting reset. I believe it happens when PC is RDP into.
    – John Doe
    Commented May 22, 2018 at 21:20
0

Download Nirsoft's WinLogOnView.

It comes with a nice interface that shows exactly who logged in, how long they were logged in for, and is generally just much easier to use and look at then scraping through event logs for hours.

https://www.nirsoft.net/utils/windows_log_on_times_view.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .