Windows 10 keeps a record of every sign-in, but it doesn’t show it anywhere obvious. The history lives in the Security log in Event Viewer, mixed in with thousands of other events. Once you know which event numbers to look for and how to filter them, you can see exactly who signed in and when, and spot failed attempts. This guide shows how, plus a quick command for checking a single account’s last sign-in.
Quick answer
Open Event Viewer, go to Windows Logs > Security, click Filter Current Log, and enter 4624 for successful sign-ins or 4625 for failed ones. You need to be signed in as an administrator.
How to check login history in Event Viewer
Step 1: Open Event Viewer
Right-click the Start button and choose Event Viewer, or type “Event Viewer” in the search box. See our guide on opening Windows Event Viewer for other ways.
Step 2: Open the Security log
In the left pane, expand Windows Logs and click Security. The middle pane fills with events. This can take a few seconds on a busy PC.
Step 3: Filter for sign-in events
In the right pane, click Filter Current Log. In the box that says <All Event IDs>, type the event ID you want and click OK:
- 4624 – a successful sign-in
- 4625 – a failed sign-in (wrong password, for example)
- 4634 or 4647 – a sign-out
You can enter more than one, separated by commas, such as 4624,4625.
Step 4: Read the event details
Double-click an event. On the General tab, scroll to the New Logon section to see the Account Name and Account Domain. The date and time appear at the bottom in the Logged field.
Step 5: Ignore the system accounts
You’ll see many 4624 events for accounts like SYSTEM, LOCAL SERVICE, NETWORK SERVICE, and names starting with DWM- or UMFD-. Those are Windows itself, not people. Look for your real user names.
Understand the logon type
Each 4624 event lists a Logon Type number that tells you how the sign-in happened:
- 2 – someone signed in at the keyboard
- 3 – network access, like opening a shared folder
- 5 – a Windows service started
- 7 – the PC was unlocked
- 10 – a Remote Desktop sign-in
- 11 – a sign-in with cached credentials (common on laptops away from the office network)
Types 2, 7, 10, and 11 are the ones that usually represent a person at the computer.
Make sure logon auditing is on
Windows 10 records successful sign-ins by default, but failed attempts may not be logged on every PC. To turn on both, open Command Prompt as an administrator and run:
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
This works on Windows 10 Home and Pro. On Pro, you can also use the Local Security Policy tool (secpol.msc) under Local Policies > Audit Policy > Audit logon events.
Check the last sign-in for one account
For a quick answer without digging through logs, open Command Prompt and type net user YourUserName. The Last logon line shows the most recent sign-in time for that account.
Use PowerShell for a cleaner list
Open PowerShell as an administrator and run:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 20
This lists the 20 most recent successful sign-ins. Change 4624 to 4625 to list failed attempts.
Tips
- The Security log has a size limit, so old events are overwritten. If you need a longer history, increase the maximum log size in the log’s Properties.
- Many failed sign-ins in a short time can mean someone is guessing your password. Change it and turn on a PIN or Windows Hello. Our guide on setting a lock screen password in Windows 10 covers the basics.
- Save a filter as a Custom View (Action > Create Custom View) so you don’t have to rebuild it each time.
- Windows 10 reached end of support in October 2025. These steps work the same way in Windows 11.
Frequently asked questions
Can I see login history without admin rights?
No. The Security log is only readable by administrators.
Does Windows record who unlocked the PC?
Yes. Unlocks appear as 4624 events with logon type 7.
How far back does the history go?
It depends on the log size and how busy the PC is. On a typical home PC, it may cover a few weeks to a few months.
Summary
- Open Event Viewer > Windows Logs > Security.
- Filter by 4624 (success) or 4625 (failure).
- Check the account name, time, and logon type.
- Turn on failure auditing with auditpol if needed.
Kermit Matthews is a freelance writer based in Philadelphia, Pennsylvania with more than a decade of experience writing technology guides. He has a Bachelor’s and Master’s degree in Computer Science and has spent much of his professional career in IT management.
He specializes in writing content about iPhones, Android devices, Microsoft Office, and many other popular applications and devices.