Have a sneaking suspicion someone else is logging in to your Windows PC while you’re away? If your bloodhound failed to track down the culprit, use these methods to uncover clues on whether someone is using your PC without your permission.
Content
- Check Recent Activity in Jump Lists
- Recent Activity (Older Versions of Windows and Windows 10)
- Check Windows Event Viewer
- Show Last Login Details at Startup
- Check Browser History
- Catch Remote Users
- Review Network Usage History
- Preventing Unauthorized Access to Your PC
Check Recent Activity in Jump Lists
While early versions of Windows 10 showed recent activity in the Start menu, that’s not the case anymore. But you can still see recent activity using jump lists.
However, Windows 11 does show recommendations in the Start menu. (The feature is turned on by default, but sneaky users might have turned it off.) These are based on recent usage, which can indicate whether someone else was using your Windows device. Of course, if they use the same apps as you, this may not tell you anything.
Instead, view recently accessed files by right-clicking apps in your Start menu and taskbar. Want to see whether someone opened a Word doc? Open any Word doc, right-click its icon on the taskbar (this also works if you have a pinned shortcut on the taskbar), and look for Recent.
You can do the same thing in your Start menu. Right-click any app you think someone may have been accessed to look for any recent items, including browser items. If your browser auto-deletes history on close, you may not see anything.
Alternately, open File Explorer, and look under Quick Access. Expand Recent to view all recently opened files.
You can also jump to the Recent Items folder. Sneaky users can delete all this activity, but they may not know this folder exists. Open File Explorer, and enter the following in the address bar:
%APPDATA%\Microsoft\Windows\Recent Items
If you don’t see a Recent section when right-clicking or checking File Explorer, the setting might not be turned on. Turn it on to catch the culprit next time. Go to Start -> Settings -> Personalization -> Start. Ensure Show recently opened items in Start, Jump Lists, and File Explorer is turned on.
Recent Activity (Older Versions of Windows and Windows 10)
Once again, check the Start menu for any new apps that may have been opened. Also, earlier versions of Windows included a Recent Items section in the Start menu. Open this to see the most recently opened files. Of course, if the recent item view isn’t turned on, or the person deletes the entry, you won’t see anything here.
Other common places to look for changes include your browser history, recent documents and the Programs option in the control panel for recently added programs. Use any of these methods to open Control Panel.
Check the Date Modified for Last File Changes
If someone is logging in to your Windows PC without permission, they may be looking to access information or change something in a file. If they make any changes, you’ve got them.
Open File Explorer, and check any folders someone might have used, such as Documents, Downloads, Pictures, etc. Look carefully at the Date modified column. If anything was modified at a time you weren’t on your PC, someone else was using the file.
Check Windows Event Viewer
The above may be all the proof you need that someone else is logging in to your Windows PC. If not, check out Event Viewer to see the latest login and logout events.
Press Win + R, and type eventvwr.msc in the Run dialog box. Press OK to open Event Viewer.
In the left pane, expand Windows Logs and select Security. In the middle pane, you’ll see multiple logon entries with date and time stamps. Every time you log in, Windows records multiple logon entries within a total time period of two to four minutes.
Look specifically for Logon and Special Logon in the Task Category column, but if you see any entries in the Security logs that occur when you are not logged in, it could mean someone else is using your PC. Selecting an event shows you more details in the bottom pane.
Event viewer is also a great way to check out your PC startup and shutdown history. This can also serve as a clue that someone might have turned on and used your PC while you were away.
Show Last Login Details at Startup
The above method is quite solid for catching the intruder, but if they were smart enough, they could have cleared all the event logs. In that case, you can set up the last login details to show as soon as the PC starts. It will show you when the account was last logged in and any failed attempts. This information cannot be deleted but will help you with future unauthorized access, as you will be setting it up next.
You will be editing the Windows Registry, so make sure you create a backup of it. Press Win + R, and enter regedit in the Run dialog box to open the Windows Registry.
To start checking previous login information in the registry, navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Right-click on the System folder and select New -> DWORD (32-bit) value.
Rename the new entry “DisplayLastLogonInfo.” Double-click on this entry, and set its value to 1.
Remember, you’ll only see data starting from this point, not before the Registry was edited. If you’re comfortable using the Registry, try these other great Registry hacks.
Check Browser History
If your browser auto-deletes history upon exit, this won’t help you. But the browsing history, such as cookies and sites visited, show everything you, and anyone who shouldn’t have been on your PC, have done online. Go to the Settings in your browser(s) menu to view the history. Also, check the URL bar for the latest autofill data.
Catch Remote Users
It’s unnerving to have someone logging in to your PC in person, but what about remotely? The methods above still work well to let you know whether a remote user has been on your PC. Typically, your Windows login history in Event Viewer shows remote login events. A few other things to check for remote Windows logins include:
- Check your PC for any new apps.
- Check your firewall. If you have a firewall installed, remote connections may show up. You may even notice a current active connection. Use your firewall to block remote users. The steps and settings vary greatly, based on the type of firewall. For the built-in Windows firewall, go to Settings -> Privacy & security -> Windows Security, then go to Open Security -> Firewall & network protection, and select Advanced Settings.
- Scan for viruses. If someone’s logging in to Windows remotely without your permission, it may be due to malware. Run a virus scan regularly to check for malicious apps. If you don’t have anything installed, consider using Windows Defender. You can also remove viruses without an antivirus.
- Check that your antivirus and firewall haven’t been disabled. If they have been, it’s a sign of malware and possible remote access.
Review Network Usage History
Only the sneakiest snoopers will think to delete the network usage history. And, if this is deleted, it’s a clear sign someone else is logging in to your Windows PC. It’s important to check the usage before logging off and immediately after logging back in to see if anything was changed.
I recommend taking a screenshot (press the Print Screen button, the Snipping tool, or another screenshot tool) to compare.
Go to Settings -> Network & internet -> Data usage. Filter by Last 24 hours, 7 days, or 30 days. If you’re using your PC daily, the Last 24 hours filter works best to catch unauthorized access. Look through the apps used, along with the amount of data used to see whether someone else has used different apps or used more data since you last logged off.
Preventing Unauthorized Access to Your PC
If you’ve discovered unauthorized Windows logins, there are several ways to prevent access in the future, such as:
- Set up a login for your PC. A password or biometric login is best.
- Always log out of your PC when you’re not using it. If someone steals your credentials, change your password immediately.
- Add separate accounts for each user, including kids. If you have a shared PC, ensure each different user has their own account. This helps protect your files and settings. Be aware, though, that kids may still get around parental controls to access things they’re not supposed to.
- Never allow remote access unless it’s a reputable app or user you fully trust.
- Use a VPN any time you use public Wi-Fi. If hackers gain access to your PC while you’re in public, they can install apps that allow them to remotely log back in later.
While placing a string or powder on your keyboard can help you uncover someone else logging in to your Windows PC, the above will help you narrow down who and when. A hidden webcam can also help you figure out who’s using your PC without permission. Outside of a more secure login, consider locking sensitive files with a strong password in Windows.
Image credit: Unsplash. All screenshots by Crystal Crowder.
Subscribe to our newsletter!
Our latest tutorials delivered straight to your inbox
Sign up for all newsletters.
By signing up, you agree to our Privacy Policy and European users agree to the data transfer policy. We will not share your data and you can unsubscribe at any time. Subscribe
Crystal Crowder –
Staff Writer
Crystal Crowder has spent over 15 years working in the tech industry, first as an IT technician and then as a writer. She works to help teach others how to get the most from their devices, systems, and apps. She stays on top of the latest trends and is always finding solutions to common tech problems.
Leave a comment