If you’re ever worried about someone logging into your account on your computer without your knowledge or consent, there are a few ways to check. One is to check the account’s history: if someone has logged in recently and changed their password, for example, that could be a sign that they were trying to access your account from outside of your computer. Another way to check is by checking the security logs: if there are any unusual activity or errors happening on your computer, that could be a sign that someone was trying to access your account from outside of your computer or even inside of it. Finally, you can try asking the person who owns the account if they’ve been able to log in recently and ask them for their password. If they don’t answer or if their answer is not helpful, you might need to reach out to customer service.
Most of the time, sharing a computer with others works out fine, but what do you do if you suspect someone is logging into your account behind your back? How do you find out or check to see if someone has successfully compromised your account?
Today’s Question & Answer session comes to us courtesy of SuperUser—a subdivision of Stack Exchange, a community-driven grouping of Q&A web sites.
The Question
SuperUser reader Erel Segal Halevi wants to know if there is a way to see if someone has logged into his account in Windows:
Is there an easy way for Erel to find out if someone has been logging into his account?
Specifically, is it possible to know if a person with administrator privileges somehow logged into my account (i.e. in order to get into my e-mail, etc.)?
The Answer
SuperUser contributor Pathfinder has the answer for us:
For those interested in what the Windows 7 version looks like, here it is (with a single user account).
Press Windows Button + R and type “eventvwr. msc”. In the Event Viewer window, expand Windows Logs, and select Security. In the middle of the window you will see a list with Date and Time, Source, Event ID, and Task Category columns. The Task Category pretty much explains the event: Logon, Special Logon, Logoff, and other details.
The events will be called Audit Success. The Task Category you will be looking for will be “Logon”.
You will have a bunch of system logins. They are normal.
What you will be looking for: Event ID 4624 (successful logons).
Under the General Tab in the area below the list, look for NEW ID, and ignore “SYSTEM”.
Logs to ignore (unless a virus login):
An indication of a login will look like this (Windows 8.1), but will probably be different in Windows 7:
Screenshot by Akemi Iwaya.
Have something to add to the explanation? Sound off in the comments. Want to read more answers from other tech-savvy Stack Exchange users? Check out the full discussion thread here.
