4

Looking at the answers and comments to this question, it seems that user log-ins can be monitored by checking for Event ID 4624 in the event logs.

Is there a way (through event logs, group policy, or other mechanism) to get Windows to display an alert (e.g. a popup or message in the notification area) when someone logs into the local machine?

Note: there is this other question (but it is about connecting to a shared folder remotely) and this question (which does not specifically ask for any alert mechanism).

Improve this question
1
  • 1
    Is there a way out of the box: NO However, that does not stop a third-party from writing software that is a watchdog and displays a notification when said event does happen. Of course from a security perspective it is far easier to disable remote access then to write software to notify you when it happens.
    – Ramhound
    Commented Oct 21, 2015 at 16:48

1 Answer 1

Reset to default
3

With Windows 7 (not sure about subsequent versions) you can create a scheduled task that is triggered by a specific event and that displays a message.

I have not tested this however so I am not sure how well it works and/or if it works for every type of login.

But you could do as follows, using that Event ID 4624 as an example:

Navigate to Task Scheduler (e.g. by right-clicking on "Computer" in Start Menu and selecting Manage...) and click on Create Basic Task...:

Windows 7 Task Scheduler

Give the Task at least a name:

enter image description here

Click Next and select "When a specific event is logged":

enter image description here

Click Next and select these values:

  • Log: Security
  • Source: Microsoft Windows security auditing.
  • Event ID: 4624

enter image description here

Click Next and select "Display a message":

enter image description here

Click Next and enter the message parameters:

enter image description here

Click Next and Finish:

enter image description here

Improve this answer

You must log in to answer this question.