How to View User Login History in Windows 10/11.
If you want to view the user login history in Windows 10/11, then this article contains step by step instructions on how to do that.
When a user logs on to a computer, Windows records the time and date of the logon in the Event Viewer. This allows system administrators to find out the last login time or view the full login history of users to gather information about their activity.
This tutorial is divided into two parts. The first part contains instructions on how to view a user's last login time, and the second part shows how to view the entire user's login history in Windows 10/11.
- Related article: How to View Last Login Time of a User in Active Directory.
Part 1. View Last Login Time in Windows 10/11.
Part 2. View Users Login History in Windows 10/11.
Part 1. How to View Last Login Time and Date in Windows 11/10.
Method 1. Find Last Login Time using NET USER Command.
The easiest way to find a user's last logon date and time in Windows 10/11, is by simply executing "NET USER <USERNAME>" command in Command Prompt or in PowerShell. To do that:
1. Open Command Prompt or PowerShell and give the following command to view all the accounts on the machine.
- net user
2. Notice the username of the account that you want to view it's last logon time, and give the following command to find user's last logon date and time:*
- net user Username
* Note: Replace the "Username" with the username of the user you want to view the last login time. (e.g. "John" in this example.)
Method 2. Find Last Login Time of All Accounts in PowerShell.
If you want to view the last login date and time of all users in Windows 10/11, then open PowerShell and give the following command:*
- Get-LocalUser | Select Name, Lastlogon
* Note: The above command will show you the last login time of all accounts on your Windows 10/11 computer. If the last logon time for a user is blank, it means that the user has never logged on to the computer.
Part 2. How to View User Login History in Windows 10/11.
Method 3. View User Login-Logout History in Event Viewer.
The Windows Event Viewer allows system users to view all events logged by the system, such as errors or additional information about what has happened, for troubleshooting purposes.
To check the login history in Event Viewer, go to Security logs and view the events with Event ID 4624 or 4648 to view the Logon times, or look at 4647 events to view the Logout times. To do that:
1. Type event viewer on the search box and then open the Event Viewer app.
2. Expand the Windows Logs and select Security.
3a. In Security logs, open one-by-one all the events with Event ID 4624 (or 4648), and find which one has as Logon Type = 2 & at Account Name shows the username of a user (and not SYSTEM, NETWORK SERVICE, etc.).*
3a. Finally, view the Logged time, to see the login time and date of the user.
4. To view the Logoff times of a user, see the events with Event ID 4647.*
* Note: To make you life easier, Create a custom view and type 4624 or 4648 for Logon, or 4647 for Logoff, or see the next method.
Method 4. View Logon & Logoff Times with WinLogOnView.
In my opinion, the easiest way to see all users' login and logout history, is by using the third-party utility WinLogOnView by NirSoft. To do that:
1. Download WinLogOnView and extract the ZIP file to a folder.
2. Explore the extracted folder and run the WinLogOnView application.
3. On your screen you will see the login and logout time of each computer user, the total duration of their connection and the IP address from which they connected (127.0.0.1 = locally).
That's it! Which method worked for you?
Let me know if this guide has helped you by leaving your comment about your experience. Please like and share this guide to help others.
We're hiring
We're looking for part-time or full-time technical writers to join our team! It's about a remote position that qualified tech writers from anywhere in the world can apply. Click here for more details.
