Tuesday 17 December 2013
If you have a shared computer at your home which is usedby your kids or
siblings too, there might have been times when you wanted to keep a check on
who is accessing the computer (and when).
The Pro version of Windows 8 comes with a built-in feature using
which you can easily record Windows logon events along with the user
information and the time at which the computer was accessed. This was available
in Windows 7 too, although not in all the versions.
We will be seeing how we can audit logon
events in Windows 8
Pro but you can trace
the exact same steps to enable the feature in Windows 7 Professional and
Ultimate versions.
Recording the Events
Step 1: The first thing we will need to do is activate the logon
event audit using Windows Group Policy Manager. Press Windows+R to open Run
box, type in gpedit.msc and press enter.
Step 2: After the Windows Group Policy
editor opens up, navigate to Local Computer Policy –> Computer
Configuration –> Windows Settings –> Security Settings –> Local
Policies –> Audit Policy. Here look for the policy audit logon events
and double click on it.
Step 3: When the logon event property window
opens up, check the success and the failure option to
audit those attempts. Finally click on the Apply button and save the settings.
From now on, Windows will log every logon event along with
some basic details.
Let’s have a look at how we can view
logon events for the purpose of reviewing them.
Viewing the events
Step 1: When you want to have a look at the logon events, press
the shortcut Windows+W and search for the view events. The search result will
return only one possible match - View
events log. Open it.
Step 2: In the Event log viewer, navigate to Windows
Logs –> Security category and look for all the events
with event ID 4624. This is the event ID for all the events that correspond to
successful logon event. Double click on it to view details like username, logon
date and time, etc.
So that was how you can record and view logon events in
Windows 8 Pro. You might have to sort the event IDs to easily view all the
logon events.
The process is a bit geeky and
requires you to do some out of the box things that a normal Windows user does
not come across in regular usage of his PC. However, if you are keen enough to
keep track of all the logon events on your computer, this is how it’s done.
Hope that helps.
