Do you think someone has been logging into your Windows PC while you have been away? If your bloodhound failed to track down the culprit, then we have some handy ways for you to find out if your PC was accessed or not. They may not have left a physical clue, but there is a good chance they left evidence in Windows somewhere. Uncover if someone else is logging into your Windows PC using any combination of the following methods.
Recent Activity in Jump Lists
Current versions of Windows 10 don’t show recent activity, outside of recently added apps, in the Start menu anymore. Skip to the next section if you’re using an an early version of Windows 10 or earlier versions of Windows.
However, you can view recently accessed files by right-clicking apps in your Start menu and taskbar. Want to see if someone opened a Word doc? Open any Word doc, right-click its icon on the taskbar (this also works if you have a pinned shortcut on the taskbar), and look for Recent.
You can do the same thing in your Start menu. Right-click any app you think someone might have accessed to see any recent items, including browser items. If your browser auto-deletes history on close, nothing may show, though.
Alternately, open File Explorer and look under “Quick Access.”
You may need to turn this setting on, if it’s not on by default. Go to “Start -> Settings -> Personalization -> Start.”
Ensure “Show recently opened items in Jump Lists on Start or the taskbar and in File Explorer Quick Access” is turned on.
Recent Activity (Older Versions of Windows and Windows 10)
Let’s start with the basics. If someone has accessed your account, then they must have used it for something. You need to check for changes to your PC that didn’t come from you.
The starting point will be the recent programs that appear in the Start menu. Click on the Start menu and see the most recent programs that were open. You will only see a change if the intruder has accessed a program that you didn’t use recently.
One of the drawbacks is that they could always delete the item from here if they are smart enough. Furthermore, if the recent item view was enabled on your PC, hover your mouse cursor over the “Recent Items” button on the right side of the Start Menu, and you will see all the files that were opened recently. The file entry will stay there even if the actual files are deleted.
Other common places to look for changes include your browser history, recent documents and the “Programs” option in the control panel for recently added programs.
Check Windows Event Viewer
The above step was just to alert you that something is wrong. Let’s get serious and dig up some solid proof if you suspect someone else is logging into your Windows PC. Windows keeps a complete record of when an account is logged in successfully and failed attempts to log in. You can view this from the Windows Event Viewer.
To access the Windows Event Viewer, press Win + R and type
eventvwr.msc in the “Run” dialog box. When you press Enter, the Event Viewer will open.
In the left pane, expand “Windows Logs” and select “Security.”
In the middle panel, you’ll see multiple logon entries with date and time stamps. Every time you log in, Windows records multiple logon entries within a total time period of two to four minutes. Focus on the time these entries were made. Look for any times that you weren’t actively logged in.
If there is an entry, it means someone did access your PC. Windows won’t make fake entries, so you can trust this data. Additionally, you can also check which particular account was accessed during that period (if you have multiple accounts). To check, double-click on a “Special Logon” entry during that period, and “Event properties” will open. Here you will see the name of the account next to “Account Name.”
If you want to check for login details regularly, you can set up custom views in Event Viewer.
Show Last Login Details at Startup
The above method is quite solid for catching the intruder, but if they were smart enough, they could have cleared all the event logs. In that case, you can set up last login details to show up as soon as the PC starts. This will show you when the account was last logged in and any failed attempts. This information cannot be deleted, but it can only help you for future unauthorized access as you will be setting it up next.
You will be editing the Windows Registry for this, so make sure you create a backup of it. Press Win + R and enter
regedit in the Run dialog box to open the Windows Registry.
In the Registry, you need to move to the below-mentioned location:
Right click on “System” folder and select “DWORD value” from the “New” option. An entry will be created ready to be renamed; you need to name it “DisplayLastLogonInfo.”
Double-click on this entry and set its value to “1.” Now whenever you (or someone else) logs into your PC, you will see first when you last logged in and any failed attempts.
Check Browser History
If your browser automatically deletes history when you close it, this won’t help. If it doesn’t, many people forget to delete their history when they’re using someone’s PC without permission. Simply open your browser(s) and access the history using the Settings menu for your specific browser.
The above methods should be able to alert you about unauthorized access. However, they will not tell you “who” actually accessed your account. So yes, you’ll need to do a little more investigative work outside of your PC. Setting up ways to track PC activity can help you narrow down your suspects, though.
Remember, if someone uses your account and is smart enough to clear their traces, it’s tricky to catch them. Always log out of your account if you leave your PC to prevent someone from using your account.
If you know any other ways to find out if someone is logging into your Windows PC behind your back, share with us in the comments below.