How to Find Who Logged Into Your Computer and When

This guide shows you how to check the login history on your Windows or macOS computer, so you can see which user accounts signed in and at what time. You’ll need administrator access to your computer to view the most complete logs, and you’ll be using built-in tools—no third-party software required.

What You’ll Need

• Administrator (admin) account access on the computer
• The login password for that admin account
• Windows: Windows 10 or 11 (steps are similar for older versions)
• macOS: any recent version (10.15 or newer recommended)

Step-by-Step

On Windows (Event Viewer)

1. Open Event Viewer. Press Windows key + R, type eventvwr.msc, and press Enter. If prompted by User Account Control, click “Yes.”
2. Navigate to the login log. In the left sidebar, expand Windows Logs, then click Security. This log records security events, including logins.
3. Filter for login events. Click Filter Current Log… in the right-hand Actions pane. In the dialog, under “Event IDs,” type 4624 (successful logon) and 4625 (failed logon), separated by a comma. Click OK.
4. Read the results. Each event shows the date and time, the user name (under “Account Name” in the General tab), and the logon type. Logon type 2 is interactive (someone at the keyboard), type 10 is Remote Desktop (RDP), and type 3 is network (file sharing).
5. Check for remote logins. For RDP logins (type 10), the event also shows the source IP address under “Source Network Address.” This tells you where the connection came from.
6. Export the list (optional). Right-click an event and select “Save Selected Events…” to keep a record, or use “Save All Events As…” to export the entire filtered view.

On macOS (Terminal command)

1. Open Terminal. Go to Applications > Utilities > Terminal, or search for it in Spotlight.
2. Run the last command. Type last and press Enter. This shows a list of all logins and logouts, with the most recent at the top. Each line shows the user name, the terminal or console (tty), the source IP for remote logins, and the date/time.
3. Filter for a specific user. Type last username (replace “username” with the account name) to see only that user’s logins.
4. Show failed attempts. Type sudo lastb and enter your admin password. This shows failed login attempts. Note that on some macOS versions, this file may not exist until a failed attempt occurs.
5. Check the current session. Type who to see who is logged in right now, and w for more detail including when they logged in.

Common Mistakes

• Filtering by the wrong event ID. Event ID 4624 is a successful logon, but it also fires for service accounts and system processes. Look at the “Account Name” and “Logon Type” fields to separate human logins from background services.
• Ignoring logon type. A login at 3 AM might be a scheduled task (logon type 4 or 5), not a person. Check the logon type before assuming someone was at the machine.
• Only checking successful logins. Failed attempts (event 4625) are often more telling. If you see many failures, someone may be trying to guess a password.
• Clearing the log. If you clear the Security log, you lose all history. Avoid clearing it unless you have a specific reason and have exported the data.
• Confusing local vs. domain accounts. On a corporate machine, the account name may include a domain prefix (e.g., COMPANY\jsmith). That is normal.

Tips

• Set a time range. In Event Viewer, use “Filter Current Log…” and set the “From” and “To” dates to narrow down to a specific day or week.
• Use the “Details” tab. In Event Viewer, the Details tab shows the raw XML of the event. The <Data Name="IpAddress"> field gives the source IP for remote logins.
• Create a custom view. In Event Viewer, right-click “Custom Views” and select “Create Custom View.” Set the event IDs to 4624 and 4625, and save it. This gives you one-click access to login history going forward.
• Check the system log too. In Windows, the System log (under Windows Logs) sometimes records shutdown and startup times, which can help you correlate when the machine was on.
• On macOS, use last -10 to see only the last 10 entries, which is quicker for a quick check.

Troubleshooting

• Event Viewer is empty or shows “No events.” This usually means auditing is not enabled. In Windows, open Local Security Policy (type secpol.msc in Run), go to Security Settings > Local Policies > Audit Policy, and double-click “Audit logon events.” Check “Success” and “Failure,” then click OK. New logins will now be recorded. Existing history is not retroactive.
• The Security log is missing entirely. This can happen if the Windows Event Log service is stopped. Press Win + R, type services.msc, find “Windows Event Log,” and ensure it is running and set to Automatic.
• You see “Access Denied” when opening the Security log. You must be an administrator. Right-click Event Viewer and choose “Run as administrator.” If you are not an admin, you cannot view this log.
• The last command on macOS shows nothing. The wtmp file may have been rotated. Try sudo last with admin privileges, or check /var/log/wtmp exists. If it is missing, there is no history to show.
• Failed logins (lastb) on macOS show “cannot open /var/log/btmp”. This file is created only after the first failed login. Run sudo touch /var/log/btmp to create it, then try again.
• You suspect someone deleted the logs. If the log has gaps or was cleared, there is no built-in way to recover it unless you have backups or a separate logging system. Consider enabling forwarding to a remote server if this is a recurring concern.

Frequently Asked Questions

Can I see who logged in if they used a different user account?

Yes. The Security log records every account that logs on, regardless of which account was used. You will see the account name in the event details.

Does this show logins from before I set up auditing?

No. Auditing must be enabled before the event occurs. If it was off, there is no record. Enable it now to capture future logins.

Can I tell if someone logged in remotely?

Yes. In Windows, look for logon type 10 (Remote Desktop) and check the source IP address. On macOS, the last command shows the source IP for SSH or remote logins.

What if the login was from a service or scheduled task?

Those appear as logon types 4 (batch) or 5 (service). They are not interactive human logins. You can filter them out by only looking at types 2 and 10.

Is there a way to get an email alert when someone logs in?

Not with built-in tools alone. You would need to set up a scheduled task in Windows or a launchd job on macOS that runs a script to check the log and send an email. This requires some scripting knowledge.

Can I see login history for a specific date in the past?

Yes. In Windows, use the filter’s date range. On macOS, use last -s YYYY-MM-DD to start from a specific date, or last -t YYYY-MM-DD to end at a date.

Related

• How to Clear Space on Google Drive
• Recover Deleted Text Messages on Android Without an App
• Shift Key Not Working on Mac? Fixes That Work