Track Windows Computer & User Activity

This guide shows you how to monitor what happens on a Windows PC—both at the system level (logins, shutdowns, software installs) and at the user level (which apps are opened, when files are accessed, and how long the machine is used). You’ll use built-in Windows tools only, so no third-party software is required. Before starting, you need administrator access to the computer you want to track.

What You’ll Need

• An account with administrator privileges on the Windows PC.
• Windows 10 or Windows 11 (the steps are nearly identical on both).
• For some methods, you may need to enable File Explorer to show hidden files and folders.

Step-by-Step

1. Enable auditing (for file and folder access). Press Win + R, type secpol.msc, and press Enter. In the left pane, expand Security Settings → Local Policies → Audit Policy. Double-click Audit object access, check Success and Failure, then click OK. This tells Windows to log file access events.
2. Turn on auditing for specific folders. Open File Explorer, right-click the folder you want to monitor (e.g., C:\Users\Public), select Properties → Security tab → Advanced → Auditing tab → Add. Choose Select a principal, type Everyone, click OK. Under Type, select Success (or both). Under Basic permissions, check Read & execute, List folder contents, and Read. Click OK twice.
3. View the security log. Press Win + R, type eventvwr.msc, and press Enter. In the left pane, expand Windows Logs → Security. Look for Event ID 4663 (file access) and 4656 (handle to object). The Account Name column shows who accessed the file.
4. Track logon and logoff events. In the same Security log, filter for Event ID 4624 (successful logon) and 4634 (logoff). The event details show the user name, logon type (2 = interactive, 10 = remote), and time. To filter: right-click Security → Filter Current Log → enter 4624,4634 in the <All Event IDs> field.
5. Monitor program launches. Open Event Viewer, go to Windows Logs → System. Filter for Event ID 4688 (process creation). The event shows the executable name (e.g., chrome.exe) and the user who launched it. Note: process creation auditing is not enabled by default on Windows 10/11. To enable it, open secpol.msc → Security Settings → Local Policies → Audit Policy → Audit process creation → check Success.
6. Use Task Scheduler for a simple activity log. Press Win + R, type taskschd.msc, and press Enter. Click Create Task. Under the General tab, name it “User Activity Log”. Under Triggers, add a trigger for At log on (any user). Under Actions, choose Start a program and enter powershell.exe. In the Add arguments field, paste: -Command "$log = 'C:\activity.log'; $user = $env:USERNAME; $time = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'; Add-Content -Path $log -Value "$time - $user logged on"". Click OK. This writes a line to C:\activity.log every time any user logs on.
7. Check the log file. Open File Explorer and navigate to C:\activity.log. You’ll see entries like 2025-01-15 08:30:12 - jdoe logged on. To track logoffs too, create a second scheduled task with the trigger At log off and a similar action.
8. Review user login history via Command Prompt. Open Command Prompt as administrator and run: net user %USERNAME%. This shows last logon time for the current user. To see all users, run net user first to list them, then net user [username] for each.
9. Use PowerShell to get system uptime. Run PowerShell as administrator and enter: Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object LastBootUpTime. This tells you when the system was last restarted, which helps you understand active periods.
10. Export the logs. In Event Viewer, right-click Security → Save All Events As to save as an .evtx file. You can also use PowerShell to export: Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4624)]]" | Export-Csv C:\logons.csv.

Common Mistakes

• Not enabling auditing first. If you skip step 1, Event Viewer will not log file access events, even though the folder auditing is configured.
• Filtering the wrong log. File access events are in the Security log, not the System log. Process creation is also in Security (after enabling audit).
• Overlooking logon types. A logon type of 2 is local, 10 is remote (RDP). If you only see type 2, you might miss remote connections.
• Using the wrong path in the scheduled task. The PowerShell script must be enclosed in double quotes and the path must exist. If the path is wrong, the task fails silently.
• Forgetting to run as administrator. Many of these steps require elevation. If you get “Access denied” or “You do not have permission”, close the app and reopen it as administrator.

Tips

• Use a dedicated log file. Keep all activity logs in one folder, e.g., C:\ActivityLogs, and set the folder to be readable only by administrators.
• Set up a daily export. Use Task Scheduler to run a PowerShell command each night that exports the Security log to a CSV file for long-term archiving.
• Combine with Windows Defender. Check the Windows Defender operational log for malware detections, which can indicate risky user behavior.
• Use the “Last Logon” column in Active Directory if you’re in a domain environment—it gives a quick overview without digging into Event Viewer.
• Test the auditing on a single folder first. Enable auditing on a test folder, access it, and verify the event appears before rolling out to all folders.

Troubleshooting

• No events appear in the Security log. Check that audit policy is enabled (step 1) and that the folder auditing is set correctly (step 2). Also confirm you’re looking at the Security log, not the Application log.
• Event ID 4663 shows “Object Server” but not the file name. This happens when auditing is enabled but the folder itself isn’t audited. Re-check the folder’s Advanced Security settings.
• The scheduled task doesn’t write to the log. Test the PowerShell command manually in a PowerShell window. If it works, check the task’s Run with highest privileges checkbox and ensure the user account has write permission to the log file.
• Logon events are missing. Some logon types (like service accounts) don’t generate 4624 events. Filter for 4624 and 4634 and check the “Logon Type” field. If you’re looking for interactive logons, filter for type 2.
• Event Viewer is slow or unresponsive. The Security log can grow huge. Right-click Security → Properties and set a maximum log size (e.g., 20 MB) and choose “Overwrite events as needed”.

Frequently Asked Questions

Can I track which websites a user visits using built-in tools?

No. Windows does not log web browsing history by default. You would need to enable DNS logging or use a third-party monitoring tool.

Do these methods work on Windows 10 and Windows 11?

Yes, the steps are the same for both. The only minor difference is the look of the Settings app, but the Event Viewer and secpol.msc tools are identical.

Will the user know they are being tracked?

If they have administrator rights, they can see the audit policies and the scheduled task. Standard users cannot easily see the security log, but they might notice the log file if they know where to look.

Can I track activity on a remote computer?

Yes, if you have admin rights on that computer and it’s on the same network, you can connect to its Event Viewer by entering the computer name in the “Connect to another computer” option. You’ll also need to enable Remote Event Log Management in Windows Firewall.

How long are events kept?

By default, the Security log can hold up to 20 MB and events are overwritten as needed. You can increase this limit in Event Viewer properties, but be mindful of disk space.

Is there a way to see when a user last opened a specific file?

Yes, if you enable auditing on that file (or its folder), the Security log will contain Event ID 4663 with the file name and the user account. You can filter by that file name.

Related

• Lunar Client Keeps Crashing on PC: Fixes
• Reset Apple Watch Without Phone or Password
• How to Disable Bixby on Samsung Galaxy Phones