You can make use of the Event Viewer utility on your Windows computer to check System Logs and find if someone had logged into your computer.
Find If Someone Had Logged into Your Computer
Sometimes you may come across the need to share the login Password for your computer with someone, in order to allow this person to access your computer for a limited period of time.
The recommended safety practice in such cases is to change the Login password, but many users either forget to change the Login password or simply do not find it necessary to do so.
If the other person with knowledge of your Login credentials has an easy access to your computer, you might be interested in checking if someone had logged into your computer, while you were away.
Steps to Find If Someone Had Logged into Your Computer
In order to find if someone had logged into your computer, you can make use of an in-built utility in Windows 10 known as “Even Viewer”.
The main purpose of Event Viewer on a Windows computer is to record system, application, security, setup and other activities happening on your computer.
The Event Viewer maintains an accurate record of all significant activities happening on your computer in the form of simple text files that can be easily accessed and viewed.
All that is required to find if someone had logged into your computer is to open the Event Viewer on your Windows computer and filter the System Logs.
1. Right-click on the Start button and click on Run.
2. In the Run Command Window, type eventvwr and click OK.
3. Once the Event Viewer is launched on your computer, expand Windows Logs > click on System and wait for System Logs to be populated on your computer.
Once the System Logs are populated, right-click on System and click on Filter Current Log option.
4. On “Filter Current Log” pop-up window, type 6005,6006 in “Event ID” field and click on OK.
5. On the Event Viewer screen, you will now see all the 6005 (Start-up time) and 6006 (Shut-down time) entries, sorted by date. You can see details of any event that you are interested in by double-clicking on it.
- 6005 – The Event Log Service was started (Start-up time)
- 6006 – The Event Log Service was stopped (Shut-down time)
A quick way to find if someone had logged into your computer is to go through the “Date and Time” column and see if there are any entries for dates/time while you were away from your computer.
