Technology in terms you understand. Sign up for the Confident Computing newsletter for weekly solutions to make your life easier. Click here and get The Ask Leo! Guide to Staying Safe on the Internet — FREE Edition as my thank you for subscribing!

Can I monitor who's using my machine?

Can I monitor who’s using my machine?

There are lots of tools out there that will allow you to monitor not just
who’s using your machine, but what they’re doing, even typing, when they do.
That’s called spyware, and requires installing additional software to be
installed to log and report the activities.

What many people don’t realize is that there are some simple logging tools
built into Windows XP already. They won’t log keystrokes, but they will at
least let you see who’s logged into your machine and what programs they ran
while they were there.

It’s off by default, but it’s easy to turn some of that logging on.

Become a Patron of Ask Leo! and go ad-free!

The settings are buried a little deep: Start, All
Programs
, Accessories, Administrative
Tools
, Local Security Policy. Once that’s opened up,
look underneath Security Settings, expand Local
Policies
by clicking on the boxed plus sign next to it, and then click
on Audit Policy.

There are several items of interest here, but we’ll focus on only three.
Start by double clicking on Audit account login events. Make
sure that both success and failure are checked, and press OK.
Repeat for Audit logon events. Those two will log when someone
logs into your computer or tries to connect to your computer via a remote
share. Now repeat the process for Audit process tracking
this one will log an event each time a process (program) starts or stops.

Now close Local Security Settings.

Use the event viewer to see the results of the logging we just enabled.

Press Start, Run, and type
eventvwr“. Click on the security item in the
left hand pane. In the right will be a list of security events, most recent at
the top. Double click on one for the details of that event. In the case of a
login event, for example, you’ll see the account used as well as the date and
time of the event. In the case of a process event, you’ll see the name of the
program that was run as well as the account that started it.

Video: This short video shows the steps I’ve outlined
above.

Subscribe to Confident Computing! Tech problem solving & safety tips & a weekly confidence boost in your inbox every week.

I'll see you there!

10 Reasons Your Computer is Slow

Slow Computer?

Speed up with my special report: 10 Reasons Your Computer is Slow, now updated for Windows 10.

NOW: name your own price! You decide how much to pay -- and yes, that means you can get this report completely free if you so choose. Get your copy now!

17 comments on “Can I monitor who's using my machine?”

  1. I have Windows 98SE and want to know how I find out who keeps getting into my Yahoo, and Outlook Express 6 and sending out mail as me. It has to be someone I know because they got into both accounts, and I regularly change passwords. Both accounts send mail to the same names also.
    I want to catch them red handed. I also suspect my daughters boyfriend is signing me up for all kind of rude sites and mail, and I would like to know if there is a way to hack his account on yahoo and change his settings so I can get a little pay back

    Reply
  2. I see a lot of internet activity on my cablemodem even when nobody is using my computer. How can I see internet traffic in my computer?

    Reply
  3. I tried to foloow this but I dont have nothing that says administrative tools where ya said to go too. On my other comp which is a compact presario, I have a hp Web Helper Notepad, that is in my computer-cdrive. But yet I dont have it on my emachine one. It helps me to keep track of where my kids are going on internet and shows all pages visited and what it was they visited. Am trying to find same thing for my emachine as well, that I can personally put in and use same way without haveing to buy something in its place I really like it can you help me to find same thing for the emachine?

    Reply
  4. I see how to turn on the audit logon events but this doesn’t seem to be an option in Windows XP Home. Do you know if it is possible to audit logons in the home edition? thanks, rita

    Reply
  5. Thanks for the tip on activating the logs for remote logins to my PC. I will start monitoring now. hope this will show all the programs like intelliviewer and mstsc.

    What i need to know is that you said abt some spyware that will help monitoring remote logins. can u name some safe ones.. i dont want it to be a nuisence after installing for a cause.

    Reply
  6. If it is not in your accessories folder, go to control panel, performance and maintenance. You will then be able to find Local Security Policy shortcut.

    Reply
  7. Leo

    As a past writers mentioned on XP Home the Local Security Policy is not on either the Control Panel or on Administrative Tools. Under Administrative Tools you do have Computer Management. How do I install or activate the Local Security Policy? Also how do I activate WMI Control which does not show any information on its screen.

    Reply
  8. i was just curious i can see what time my computer was logged on but what i would like to know is what time they logged off.

    Reply
  9. Someone is using my computor vista and I am afraid they will put a virus on my computor and I have some work info on here how do I find out all the names using my computor

    Reply
  10. Yes you can with special software.
    I’m Mac user and have Logon Sentry – special software which monitors all logon times.

    Reply

Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.