How to log all log in – log off – lock – unlock events in Windows 10
One of the questions I got during my free assistance during lock off offer for those being locked up at home was how to log all login / logoff attempts on a shared computer. A father wanted to know how to check kids computer time on a shared family computer.
With Windows Event Viewer, this is quite simple, as the following video shows:
The video shows how to log all following events:
– Event ID 4625 > Credentials rejected
– Event ID 4647 > Sign out (log off)
– Event ID 4648 > Sign in (log in)
– Event ID 4800 > Workstation locked
– Event ID 4801 > Workstation unlocked
These events will be logged from all users and can be read in Event Viewer.
This is very practical, if you administrate a shared computer. You can always check who logged in at what time, when computer was locked or unlocked, and so on.
Kari
Author: Kari Finn
A former Windows Insider MVP, Kari started in computing in the mid 80’s writing code for VAX / VMS systems. Since then, he’s worked in a variety of IT positions. He specializes in Windows image capture, customization, repair and deployment as well as Hyper-V virtualization. Kari is a proud Team Member at number #1 Windows site TenForums.com.