How To Enable Auditing In Windows 10

Always wonder if you can track user logon activities in Windows so that you can have a tape of who logged in and when they log in? This is perfectly possible in the Windows arrangement using the Logon Auditing feature. Tracking user login and log off activities are very useful in server or organization environments where data is confidential and in situations where you but want to know "who did this" in your Windows system. By default, the Logon Auditing feature is disabled in Windows. In this article, permit united states of america run across how to enable Logon Auditing and how to see those tracking events on a Windows system.

Note: Logon Auditing is but available in Pro, Ultimate and Enterprise versions of Windows eight.

What is Logon Auditing

Logon Auditing is a built-in Windows Grouping Policy Setting which enables a Windows admin to log and inspect each case of user login and log off activities on a local computer or over a network. Along with log in and log off effect tacking, this feature is also capable of tracking any failed attempts to log in. This is particularly helpful in determining and analyzing any attacks on your Windows machine.

Enable Logon Auditing

To enable Logon Auditing, we need to configure Windows Group Policy settings. Press "Win + R", type gpedit.msc and press the Enter button to open up Windows Grouping Policy Editor.

Once y'all are in the Group Policy Editor, navigate to "Calculator Configuration -> Windows Settings -> Security Settings -> Local Policies" so select "Audit Policy" in the left pane.

The above activeness will bear witness you some policies on the right pane. Here double click on "Inspect logon events" policy to open it. Delight don't confuse "Inspect logon events" with "Audit account logon events" every bit it is a setting for a completely different purpose.

Once the Window is opened, select both the check boxes "Success" and "Failure." Now click on the "Employ" and "Ok" buttons to save the changes.

That's all there is to do. From this point forward, every log in, log off and failed log in attempts volition be logged in the Event Viewer as events.

View Logon Inspect Events

You can view all the log in, log off and failed log in attempt events in the Windows Effect Viewer. You can launch the Event Viewer by searching in the starting time menu. If you lot are using Windows 8, you lot tin can launch the same using the Ability User menu (Win + X).

Once you have launched the Outcome Viewer, navigate to Windows Logs and so to the Security tab.

Here you will find all the security related events that happened in your Windows system. If you double click on the keyword "Audit Success," you will observe out the details similar the user that has been logged in or logged out, time stamp, etc. Equally a tip, you tin can filter down the event logs using "Effect ID" or "Task Category." Every bit you can see from the below paradigm, Logon Auditing likewise tracks whatsoever failed login attempts.