How to know if someone tried (physically) to use your computer

First, you should know that if you don’t have a login password on your computer, you won’t be able to easily tell if someone has tried to use it (although you can tell when they have). turned on and off). We assume that if you live in a place where there are several “candidates” to use the PC, you will have a password protected login.

Prepare your PC: prerequisites and steps

Windows lets you create multiple user profiles to allow multiple people to use the same computer, but what if it’s your home computer and only you should be able to use it? Finding out if someone has tried to enter your session is quite simple and below we’ll show you how, if they were successful (i.e. they know your password and you should change) or failed login attempts.

In order to find out if someone has tried to log into the PC as your user, you must first enable account auditing in Windows, although this is usually enabled by default. You should also know that it does not work on the Home version of Windows, it is only available on the Pro, Enterprise and Edu versions.

To enable auditing, right-click Start and select Run (or press WIN+R). In the window that appears, type “gpedit.msc” (without quotes) and the Windows Group Policy Editor will open. The next thing you need to do is navigate, in the left menu, to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy.

Here you need to double-click on “Audit connection events” and check both boxes in the tab that appears. Do the same with “Audit account sign-in events” if you sign in to your PC with a Microsoft account and not a local account.

Once done, press OK and restart the PC: you will be ready to know if someone has tried to use your computer without your permission.

Finding out if someone tried to use your computer is as simple as that

When you’ve already set it up, it’s pretty easy to check if someone has tried to use your computer. Simply press the Windows key and type “event viewer”, or press WIN+R and in the Run window type “eventvwr.msc” without the quotes. Windows Event Viewer will open. Here you need to view “Windows Logs” on the left side and then click on Security. Then, on the right side, click Filter Current Record…

A window will open to filter the information. Where it is written you should write “4624.2625” (as is, with the comma in between, no spaces and no quotes), and you will get a report of all valid and failed connections on your PC, with their specific dates and times, with which you can already assume if someone tried to enter your PC without your permission when you were not there.