Prepare your PC: prerequisites and steps
Windows allows you to create multiple user profiles to allow multiple people to use the same computer, but what if it’s your personal computer and only you should be able to use it? Knowing if someone has tried to enter your session is quite simple and below we will show you how, whether they have succeeded (that is, they know your password and you should change it) or if the attempts to log in have failed.
To enable auditing, right-click Start and select Run (or press WIN + R). In the window that appears, type “gpedit.msc” (without the quotes) and the Windows group policy editor will open. The next thing you should do is navigate, through the menu on the left, to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy.
Here you must double click on “Audit login events” and check both boxes in the tab that appears. Do the same with “Audit account login events” if you log in to your PC with a Microsoft account and not a local account.
Once this is done, press OK and restart the PC: you will be ready to find out if someone has tried to use your computer without your permission.
Knowing if someone has tried to use your computer is that simple
When you have this already configured, checking if someone has tried to use your computer is quite easy. Simply press the Windows key and type “event viewer”, or press WIN + R and in the Run window type “eventvwr.msc” without the quotes. The Windows event viewer will open. Here you must display “Windows Logs” on the left side and then click on Security. Then, on the right side, click on Filter current record…
A window will open to filter the information. Where it says