Steps to view logs and usage history of windows 10 computers

Step 1: You proceed to open the Start Menu and enter RUN to open the quick access window on the computer.

Picture 1 of Steps to view logs and usage history of windows 10 computers

Step 2: Then, you proceed to enter the command 'gpedit.msc' and press Enter to open the Local Group Policy Editor .

Picture 2 of Steps to view logs and usage history of windows 10 computers

Step 3: When the Local Group Policy Editor is opened, you proceed to access the folders in turn as follows.

Computer Configuration (1) => Windows Settings (2) => Security Settings (3) => Local Policies => Audit Policy (4)

Picture 3 of Steps to view logs and usage history of windows 10 computers

Step 4: Then, right-click on the Audit logon events item and select Properties .

Picture 4 of Steps to view logs and usage history of windows 10 computers

Step 5: In the Audit logon events Properties window , you proceed to tick 02 items: Success and Failure (1) and click OK (2) to complete.

Picture 5 of Steps to view logs and usage history of windows 10 computers

Step 6: After completing the setup, continue to press the Windows + R combination to open the Run window. This time, we will need to enter the command ' eventvwr.msc ' and press Enter to open it.

Picture 6 of Steps to view logs and usage history of windows 10 computers

Step 7: In the Event Viewer window , go to Windows Logs (1) => Security (2) .

Picture 7 of Steps to view logs and usage history of windows 10 computers

Step 8: At the interface displayed, you are only interested in the middle dialog box and your job is to find the keys with ID: 4624 Logon .

Explanation: ID 4642 means successful login attempts on a Windows computer and next to it has a timeline for you to compare.

In addition to ID 4642, you can also get more information through the following Event IDs:

  • Event ID 4634: Turn off the computer completely (turn off with Start Menu => Shutdown)
  • Event ID 1074: The process of shutting down the computer with an application (usually Windows Update or Reboot after removing the application or software)
  • Event ID 6006: Turn off all events, this means Windows 10 is completely shut down
  • Event ID 6008: The computer is suddenly turned off (power failure. BsoD, pressing the power button, etc.)
  • Picture 8 of Steps to view logs and usage history of windows 10 computers

    In this article, TipsMake has shown you how to check the log, history of using Windows computers. Have a nice day!

    ncG1vNJzZmismaXArq3KnmWcp51kwLWxz6xkraddq7amw4ylpqCrXZa7pXnUrJignV2dtrTAzquwZqeWYsSqusOorqxlYWV6pLvMqaytnaKo