How to view who logged on to a Windows 10 computer

Page 1 of 2 12 LastLast

  1. Posts : 15
    Windows 10
       #1

    How to view who logged on to a Windows 10 computer


    Hi there!

    I have a Windows 10 computer that a few users remotely login to it to use an application.
    I am trying to find out how often they are logging in to it.

    To find out:
    I go to Event Viewer - Windows Logs - Security and filter the log with 4624 which is the Event ID for Logons

    I can see the user login but unfortunately, it logs bunch of SYSTEM logons too under this Event ID.

    Is there a way to display only the real users not SYSTEM?

    New Logon:
    Security ID: domain\userName
    Account Name: userName


    I appreciate any help!

    Thanks!

    PS: Windows 10 - Version 22H2
      My Computer


  2. Posts : 9,749
    Mac OS Catalina
       #2

    Not without auditing being done by using Event viewer to see the log of which of the onboard users for the OS logged in.
      My Computer


  3. Posts : 16,591
    Windows 10 Home x64 Version 22H2 Build 19045.4046
       #3

    I monitor these without the event you refer to. I don't have remote users but I think my view captures all users.
    User log on-off.zip

    To import a Event viewer, Custom view definition you can use the procedure posted in
    Import Event viewer, Custom views - Power state transitions - my post #4 - TenForums


    All the best,
    Denis
      My Computer


  4. Posts : 16,591
    Windows 10 Home x64 Version 22H2 Build 19045.4046
       #4

    And please do post back to say how you got on [for the benefit of future users who land on this thread after having searched the forum].

    All the best,
    And thanks for the rep,
    Denis
      My Computer


  5. Posts : 15
    Windows 10
    Thread Starter
       #5

    Denis, this is better than what I could find but it's not perfect. I am basically trying to find out the list of users who logged on to this computer. Event viewer shows System logins too, so you have to scroll down to see real human logins, I wish Microsoft would have a unique Event ID for real human logons, so that I could filter the result.

    So, I basically I gave up on this. I can't believe Microsoft doesn't give me this information easily.
      My Computer


  6. Posts : 18,044
    Win 10 Pro 64-bit v1909 - Build 18363 Custom ISO Install
       #6

    Hello @selim,

    selim said:
    I am basically trying to find out the list of users who logged on to this computer. I wish Microsoft would have a unique Event ID for real human logons, so that I could filter the result.
    Is this of any help ? > Logon Events (ID 4624)

    I hope this helps.
      My Computer


  7. Posts : 9,749
    Mac OS Catalina
       #7

    selim said:
    Denis, this is better than what I could find but it's not perfect. I am basically trying to find out the list of users who logged on to this computer. Event viewer shows System logins too, so you have to scroll down to see real human logins, I wish Microsoft would have a unique Event ID for real human logons, so that I could filter the result.

    So, I basically I gave up on this. I can't believe Microsoft doesn't give me this information easily.
    You do have access to this info on Windows. Microsoft does not hide it. We have given you the same information over and over how to see that info in Event Viewer. The only info it will show is those users that are assigned on that PC that you have setup for logging into the OS, not some random user that is on this planet. The same goes for Domain logins.
      My Computer


  8. Posts : 9,749
    Mac OS Catalina
       #8
      My Computer


  9. Posts : 16,591
    Windows 10 Home x64 Version 22H2 Build 19045.4046
       #9

    selim said:
    Denis, this is better than what I could find but it's not perfect. I am basically trying to find out the list of users who logged on to this computer. Event viewer shows System logins too, so you have to scroll down to see real human logins, I wish Microsoft would have a unique Event ID for real human logons, so that I could filter the result.
    The Custom view definition I provided does not show System logins and it does not include EventID 4624.

    Paul - It's EventID 4624 that messes things up and is what the OP is trying to get away from. EventID 4624 captures all System 'logins'.

    Denis
      My Computer

  10.   My Computers


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 00:38.
Find Us




Windows 10 Forums