Your Windows 11 PC holds a lot of personal and sensitive information — files, browser data, saved passwords, photos, emails, work documents, and more. Naturally, you want to ensure that no one else is logging in without your knowledge. Whether you share a device, suspect unauthorized access, or simply want peace of mind, Windows provides several ways to detect unexpected sign-ins.
If you’re here reading this, you’re likely wondering if someone has been using your PC when you weren’t around, or if someone remotely accessed your system. The good news? Windows 11 includes built-in logs, security features, and account tools that let you monitor login history, track failed attempts, detect remote connections, and even check activity tied to your Microsoft account.
In this detailed guide, we’ll walk you through all the reliable ways to check if someone else is logging into your Windows 11 PC, along with additional security steps you can take.
Let’s get started!
1. Check Windows Sign-In Logs Using Event Viewer (Most Accurate Method)
Windows records every login attempt — successful or failed — in the Event Viewer.
- Press Windows + X, then select Event Viewer.
- In the left sidebar, navigate to:
Windows Logs → Security
- Look for events with the Event ID 4624 (successful login).
- Look for Event ID 4625 (failed login).
- Click on an event to see details like:
- Login time
- Username used
- Login type (local, remote, network)
- Source machine
What the login types mean:
- Type 2: Physical login (someone at your PC)
- Type 3: Network login
- Type 10: Remote Desktop login
- Type 7: Unlock (someone woke or unlocked your device)
If you see unfamiliar times or usernames, someone might be accessing your PC.
2. Check Recent Account Sign-In Activity Through Microsoft Account
If you use a Microsoft account to sign in, Microsoft logs activity across devices.
- Visit: https://account.microsoft.com/account
- Sign into your account.
- Click Security.
- Select Review activity.
You’ll see:
- Login times
- Device name
- Location
- IP address
- Whether access was successful
If you spot unfamiliar locations or devices, your account may be compromised.
3. View Currently Logged-In Users on Your PC
If you suspect someone is logged in right now, you can check active sessions.
- Press Ctrl + Shift + Esc to open Task Manager.
- Click the Users tab.
- Look for unexpected accounts listed as active.
If you see a user session you don’t recognize, disconnect their session immediately.
4. Check for Remote Desktop Access Attempts
If Remote Desktop is enabled, someone may use it to connect without your knowledge.
- Press Windows + R, type:
eventvwr.msc
- Navigate to:
Applications and Services Logs → Microsoft → Windows → TerminalServices-LocalSessionManager
- Look for events indicating remote logins or attempts.
Also check:
TerminalServices-RemoteConnectionManager
If you don’t use Remote Desktop, disable RDP entirely (Fix #11).
5. Check Recently Accessed Files and Apps
If someone has logged in, they probably opened apps or files.
- Open File Explorer.
- Go to Quick Access to view Recent files.
- Check Recent items folder:
%APPDATA%\Microsoft\Windows\Recent
- Check Start menu’s Recommended items.
If you see unfamiliar files, it may indicate someone used your PC.
6. Check Browser History and Account Access
Modern browsers sync across platforms, making unauthorized activity easier to detect.
- Open Chrome/Edge/Firefox.
- Look at History (Ctrl + H).
- Look for:
- Websites visited at odd hours
- Logins you didn’t perform
- Downloads
For Chrome/Edge:
Check synced devices under Settings → You and Google / Profiles.
7. Check Windows Login Password Change Attempts
Unauthorized users often attempt to change your password.
- Open Event Viewer.
- Navigate to:
Windows Logs → Security
- Look for Event ID 4723:
- Indicates a password change attempt.
- If it says “Attempt failed,” someone tried the wrong password.
8. Check for Wake-Up Events (Laptop Access When Closed)
If your laptop wakes unexpectedly, it may indicate someone opened or used it.
- Open Command Prompt and type:
powercfg /lastwake
This shows the last device or event that woke your PC.
If it woke from sleep when you weren’t around, investigate further.
9. Check for Unauthorized Scheduled Logins or Tasks
Malware or unauthorized users sometimes set tasks to execute at login.
- Open Task Scheduler.
- Check:
Task Scheduler Library → Microsoft → Windows
Look for:
- Unknown scripts
- Suspicious tasks
- Programs run at logon
10. Enable Login Notifications Using Local Security Policy (Optional)
You can configure Windows to notify you of every failed login attempt.
- Press Windows + R, type secpol.msc, press Enter.
- Navigate to:
Local Policies → Security Options
- Enable:
- Audit logon events
- Audit account logon events
You’ll get logs for every login success or failure.
11. Disable Remote Access to Prevent Unauthorized Sign-Ins
Unauthorized login attempts often come through remote access tools.
Turn off Remote Desktop:
- Press Windows + I → System → Remote Desktop.
- Turn off Remote Desktop.
Disable remote assistance:
- Search Allow Remote Assistance.
- Uncheck Allow Remote Assistance connections to this computer.
Uninstall remote tools you don’t recognize:
- TeamViewer
- AnyDesk
- Chrome Remote Desktop
- UltraViewer
- Remote utilities
12. Change Your Password and Enable 2FA
If you suspect unauthorized access, secure your account immediately.
- Go to Settings → Accounts → Sign-in options.
- Change your Windows password.
- If using a Microsoft account, enable:
- Two-step verification
- Authenticator app login
This instantly locks out unauthorized users.
13. Set Your PC to Ask for Password on Wake
This prevents hidden or unnoticed sessions.
- Go to Settings → Accounts → Sign-in options.
- Under If you’ve been away…, choose:
- Every time
Now the PC will require your password anytime it wakes from sleep.
Wrapping Up
Your Windows 11 PC stores a lot of important information, so keeping track of sign-ins is essential. Thankfully, Windows provides multiple ways to monitor login activity, detect unauthorized access, and secure your system. By checking your Event Viewer logs, reviewing Microsoft account activity, and disabling remote access features, you can ensure that nobody else is logging into your system without your knowledge.
