How to view who logged on to a Windows 10 computer

selim · 21 Mar 2023

Hi there!

I have a Windows 10 computer that a few users remotely login to it to use an application.
I am trying to find out how often they are logging in to it.

To find out:
I go to Event Viewer - Windows Logs - Security and filter the log with 4624 which is the Event ID for Logons

I can see the user login but unfortunately, it logs bunch of SYSTEM logons too under this Event ID.

Is there a way to display only the real users not SYSTEM?

New Logon:

	Security ID:		domain\userName

	Account Name:		userName

I appreciate any help!

Thanks!

PS: Windows 10 - Version 22H2

bro67 · 21 Mar 2023

Not without auditing being done by using Event viewer to see the log of which of the onboard users for the OS logged in.

Try3 · 22 Mar 2023

I monitor these without the event you refer to. I don't have remote users but I think my view captures all users.
User log on-off.zip

To import a Event viewer, Custom view definition you can use the procedure posted in
Import Event viewer, Custom views - Power state transitions - my post #4 - TenForums

All the best,
Denis

Try3 · 23 Mar 2023

And please do post back to say how you got on [for the benefit of future users who land on this thread after having searched the forum].

All the best,
And thanks for the rep,
Denis

selim · 23 Mar 2023

Denis, this is better than what I could find but it's not perfect. I am basically trying to find out the list of users who logged on to this computer. Event viewer shows System logins too, so you have to scroll down to see real human logins, I wish Microsoft would have a unique Event ID for real human logons, so that I could filter the result.

So, I basically I gave up on this. I can't believe Microsoft doesn't give me this information easily.

Paul Black · 23 Mar 2023

Hello @selim,

selim said:

I am basically trying to find out the list of users who logged on to this computer. I wish Microsoft would have a unique Event ID for real human logons, so that I could filter the result.

Is this of any help ? > Logon Events (ID 4624)

I hope this helps.

bro67 · 23 Mar 2023

selim said:

Denis, this is better than what I could find but it's not perfect. I am basically trying to find out the list of users who logged on to this computer. Event viewer shows System logins too, so you have to scroll down to see real human logins, I wish Microsoft would have a unique Event ID for real human logons, so that I could filter the result.

So, I basically I gave up on this. I can't believe Microsoft doesn't give me this information easily.

You do have access to this info on Windows. Microsoft does not hide it. We have given you the same information over and over how to see that info in Event Viewer. The only info it will show is those users that are assigned on that PC that you have setup for logging into the OS, not some random user that is on this planet. The same goes for Domain logins.

bro67 · 23 Mar 2023

How to See Who Logged Into a Computer (and When)

Try3 · 24 Mar 2023

selim said:

Denis, this is better than what I could find but it's not perfect. I am basically trying to find out the list of users who logged on to this computer. Event viewer shows System logins too, so you have to scroll down to see real human logins, I wish Microsoft would have a unique Event ID for real human logons, so that I could filter the result.

The Custom view definition I provided does not show System logins and it does not include EventID 4624.

Paul - It's EventID 4624 that messes things up and is what the OP is trying to get away from. EventID 4624 captures all System 'logins'.

Denis

das10 · 24 Mar 2023

How about:
WinLogOnView - Displays logon / logoff times on Windows 10 / 8 / 7 / Vista /2008