Steps to view logs and usage history of windows 10 computers

Step 1: You proceed to open the Start Menu and enter RUN to open the quick access window on the computer.

Steps to view logs and usage history of windows 10 computers Picture 1

Step 2: Then, you proceed to enter the command 'gpedit.msc' and press Enter to open the Local Group Policy Editor .

Steps to view logs and usage history of windows 10 computers Picture 2

Step 3: When the Local Group Policy Editor is opened, you proceed to access the folders in turn as follows.

Computer Configuration (1) => Windows Settings (2) => Security Settings (3) => Local Policies => Audit Policy (4)

Steps to view logs and usage history of windows 10 computers Picture 3

Step 4: Then, right-click on the Audit logon events item and select Properties .

Steps to view logs and usage history of windows 10 computers Picture 4

Step 5: In the Audit logon events Properties window , you proceed to tick 02 items: Success and Failure (1) and click OK (2) to complete.

Steps to view logs and usage history of windows 10 computers Picture 5

Step 6: After completing the setup, continue to press the Windows + R combination to open the Run window. This time, we will need to enter the command ' eventvwr.msc ' and press Enter to open it.

Steps to view logs and usage history of windows 10 computers Picture 6

Step 7: In the Event Viewer window , go to Windows Logs (1) => Security (2) .

Steps to view logs and usage history of windows 10 computers Picture 7

Step 8: At the interface displayed, you are only interested in the middle dialog box and your job is to find the keys with ID: 4624 Logon .

Explanation: ID 4642 means successful login attempts on a Windows computer and next to it has a timeline for you to compare.

In addition to ID 4642, you can also get more information through the following Event IDs:

1. Event ID 4634: Turn off the computer completely (turn off with Start Menu => Shutdown)
2. Event ID 1074: The process of shutting down the computer with an application (usually Windows Update or Reboot after removing the application or software)
3. Event ID 6006: Turn off all events, this means Windows 10 is completely shut down
4. Event ID 6008: The computer is suddenly turned off (power failure. BsoD, pressing the power button, etc.)

Steps to view logs and usage history of windows 10 computers Picture 8

In this article, TipsMake has shown you how to check the log, history of using Windows computers. Have a nice day!

Jessica Tanner

Update 03 June 2021