Isn’t it worrisome if you had kept your PC unattended with or without a password lock thinking that someone might try to log in? The issue is even more profound when you are using a shared PC with multiple users such as in an office. The question is, can you record any Windows login attempts be they successful or failed. Windows OS gives you access to system logs where you can find if someone tried to log in on your desktop/laptop and records both successful and failed attempts.
How To Check Login Attempts on Windows?
These step-by-step instructions let you check login attempts on Windows counting both failed and successful attempts including time, date, level, and other information. Let’s see how it works out.
Part 01: Configuring Event Viewer
This particular section deals with configuring the event viewer that will be helpful in capturing events i.e. login attempts (successful and failed ones) once setup.
Step #1: First up, open Event Viewer on your PC by pressing Ctrl + R on the keyboard and typing the command “eventvwr”, and hitting OK.
Event Viewer on your Windows PC should turn on.
Step #2: The page is basically divided into three sections. You need to tap on the “Custom Views” folder on the left side of the screen.
Step #3: Next, go to the extreme right side of the screen and tap on “Create Custom View…”.
Step #4: A dialog box will appear on the screen where you need to select “By log”, tap on the dropdown menu, extend Windows Logs >> Security” and click outside the menu.
Step #5: Next up, check out the Task Category and you should see “
Step #6: You can enter the following ID numbers to record the corresponding events.
- 4624 – Successful Login
- 4625 – Login Failure
- 4634 – Log off
Enter the following value in the said text field to record the said events.
Step #7: Hit “OK” and another dialog box will appear where you need to name it. Hit “OK” to save the said custom event.
Step #8: If you only want access to check login attempts on Windows, you can uncheck “All Users” before hitting the “OK” button.
Step #9: As you can see, we did run the procedure for the “Login Failure” event only, you have two other events that you can create a new custom view for. Simply repeat Step #3 to Step #8 and you are good to go.
Part 2: Review The Events
Now that you have created the said events, it is time to check whether it works or not. Here’s how you can do it.
Step #1: Firstly, press “Ctrl+R” and run the command “eventvwr” to launch the Event Viewer.
Step #2: Tap on “Custom Views” to expand it on the left side of the screen.
Step #3: Double-click on the event you want to check out and you should be able to check out the events when they were triggered.
Step #4: You can check out for more information on the event log in the respective events themselves to get a clear picture.
Enable Logon Auditing on Windows
In case you aren’t able to see any events within the Event Viewer, it’s possible that the Login Auditing feature on your PC is disabled. Here’s how you can enable it. Note that you need Group Policy Editor on your PC/laptop to enable it and which means, it won’t be accessible on Windows 7 Home and Windows 8 standard versions.
Step #1: Open Group Policy Editor by pressing the Ctrl+R to launch the launch command.
Step #2: Type the command “gpedit.msc” and hit enter.
Step #3: You will get an interface with folders on the left that you can tap to extend in a tree structure. You need to follow Computer Configuration >> Windows Settings >> Security Settings >> Local Policy >> Audit Policy” and it will be accessible on the other half of the screen.
Step #4: Locate “Audit logon events” and click on it. You might need to double tap on it to access it.
Step #5: Next, under “Audit these attempts”, checkmark both “Success” and “Failure” and finally, tap on “Apply >> OK”.
Step #6: Repeat Part 2 “Reviewing Event Viewer” to check whether you can check login attempts on Windows now no not.
Wrapping Up
You can check out the instructions on how you can check login attempts on Windows PCs and laptops. Depending upon the use cases, you can check out these events and take appropriate measures to safeguard your PC against unauthorized login attempts.
