See failed logons in Windows 10

Question

I understand that you can see failed logons in Windows 10 - how can I do that?

Also, can you filter that by failed or successful logins? This is for Windows 10, Home Edition.

Solution

Yes it is possible. But first you have to enable it in your group policy.

1. Press Win + R and enter gpedit.msc (folowed by pressing return)
2. Click through the following tree:

   Computer Configuration → Windows Settings → Security Settings → Local Policies → Audit Policy

3. On the right panel double-click Audit logon events
4. Mark Success and Failure (if you want both to be logged)
5. Confirm those settings by pressing the OK button

You can now find your Audit Failure and Success entries in your eventviewer:

1. Press Win + R and enter eventvwr (followed by pressing return)
2. Open the Windows Logs Tree and click on Security

There you will find all entries.

You can also create a filter to only show your successful and failed logon attempts:

1. On the eventviewer click on Filter Current Log...
2. Change <All event IDs> to 4624,4625

The eventID 4624 shows your successful attempts, thereas 4625 shows the failed ones.

Remember: you will only find those attempts being logged since you've changed the group policy! So you can't see it for the past.

Comments

[H. Pauwelyn]

Sorry, but he can't find gpedit.msc.

[A1985]

Ah you are using the home version... There is no group policy editor included. However you can install it. You can find a how to on the following page: askvg.com/… Even though it's saying that it's for Windows 7 it should be working on Windows 10 too.

[JW0914]

Is Local Security Policy [secpol.msc] also not included in Home? If it is, Security Settings - Local Policies - Audit Policy