Isn’t it worrying if you left your PC unattended with or without a locked password thinking someone might try to log in? The problem is even deeper when you use a shared PC with several users, such as in an office. The question is, can you log all Windows login attempts, whether successful or failed. Windows operating system gives you access to system logs where you can find if someone tried to login on your desktop/laptop computer and record successful and failed attempts.
How do I check login attempts in Windows?
These step-by-step instructions allow you to check login attempts on Windows by counting failed and successful attempts, including time, date, level, and other information. Let’s see how it works.
Part 01: Configuring Event Viewer
This particular section deals with the configuration of the event viewer which will be useful for capturing events i.e. login attempts (successful and failed) once configured.
Step 1: First, open Event Viewer on your PC by tapping CTRL+R on the keyboard and typing the command “vwr event”and knock OKAY.
Event Viewer on your Windows PC should turn on.
2nd step: The page is basically divided into three sections. You have to press the “Custom views” folder on the left side of the screen.
Step 3: Then go to the far right of the screen and press “Create a custom view…”.
Step 4: A dialog box will appear on the screen where you need to select “By log”tap the drop-down menu, expand Windows Logs >> Security” and click outside the menu.
Step 5: Then check out the Task category and you should see “
Step 6: You can enter the following ID numbers to record the corresponding events.
-
- 4624 – Connection successful
- 4625 – Login Failed
- 4634 – Disconnect
Enter the following value in said text field to log said events.
Step #7: Hit “OKAY” and another dialog box will appear where you need to name it. Hit “OKAY” to record said custom event.
Step 8: If you only want to access verification of login attempts in Windows, you can uncheck “All the users” before hitting the “OKAY” button.
Step 9: As you can see we ran the procedure for the “Connection Failed” event only, you have two other events for which you can create a new custom view. Just repeat Step #3 to Step #8 and you are good to go.
Part 2: Review the Events
Now that you have created said events, it’s time to check if it works or not. Here’s how you can do it.
Step 1: First, press “Ctrl+R” and run the command “vwr event” to launch the Event Viewer.
2nd step: Press on “Custom views” to expand it on the left side of the screen.
Step 3: Double click on the event you want to check and you should be able to check the events when they were triggered.
Step 4: You can check for more information about the event log in the respective events themselves to get a clear picture.
Enable Login Auditing in Windows
If you are unable to see events in Event Viewer, your PC’s login auditing feature may be disabled. Here’s how you can enable it. Note that you need the Group Policy Editor on your PC/laptop to enable it, which means it won’t be accessible on standard versions of Windows 7 Home and Windows 8.
Step 1: Open the Group Policy Editor by pressing the button CTRL+R to issue the launch command.
2nd step: Type the command “gpedit.msc” and press enter.
Step 3: You will get an interface with folders on the left which you can tap to expand in a tree view. You must follow Computer Configuration >> Windows Settings >> Security Settings >> Local Policy >> Audit Policy » and it will be accessible on the other half of the screen.
Step 4: Locate “Audit connection events” and click on it. You may need to double tap it to access it.
Step 5: Then under “Audit these attempts”tick both “Hit” and “Failure” and finally, yourp on “Apply >> OK”.
Step 6: Repeat part 2 “Event Viewer Review” to check if you can check login attempts on windows now not.
Wrap
You can see instructions on how you can check login attempts on Windows PCs and laptops. Depending on the use cases, you can check these events and take appropriate action to protect your PC from unauthorized login attempts.
Related
