Most of the time, sharing a computer with others works out fine, but what do you do if you suspect someone is logging into your account behind your back? How do you find out or check to see if someone has successfully compromised your account?
Today’s Question & Answer session comes to us courtesy of SuperUser—a subdivision of Stack Exchange, a community-driven grouping of Q&A web sites.
SuperUser reader Erel Segal Halevi wants to know if there is a way to see if someone has logged into his account in Windows:
In Windows 7, is there a way to know if somebody has logged into my account when I was absent?
Specifically, is it possible to know if a person with administrator privileges somehow logged into my account (i.e. in order to get into my e-mail, etc.)?
Is there an easy way for Erel to find out if someone has been logging into his account?
SuperUser contributor Pathfinder has the answer for us:
- Press Windows Button + R and type “eventvwr.msc”.
- In the Event Viewer window, expand Windows Logs, and select Security.
- In the middle of the window you will see a list with Date and Time, Source, Event ID, and Task Category columns. The Task Category pretty much explains the event: Logon, Special Logon, Logoff, and other details.
The events will be called Audit Success. The Task Category you will be looking for will be “Logon”.
You will have a bunch of system logins. They are normal.
What you will be looking for: Event ID 4624 (successful logons).
Under the General Tab in the area below the list, look for NEW ID, and ignore “SYSTEM”.
Logs to ignore (unless a virus login):
An indication of a login will look like this (Windows 8.1), but will probably be different in Windows 7:
For those interested in what the Windows 7 version looks like, here it is (with a single user account).
Screenshot by Akemi Iwaya.
Have something to add to the explanation? Sound off in the comments. Want to read more answers from other tech-savvy Stack Exchange users? Check out the full discussion thread here.