Check User Login History in Windows Active Directory

Step 1 – Enable Advanced Auditing for User Logon and Logoff Events

1. Open Group Policy Management by running gpmc.msc.
2. Create a new GPO and link it to the OU containing the computers you want to audit.
3. Right-click the GPO and select Edit.
4. Navigate to:
   Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Logon/Logoff
5. Open Audit Logon and enable Success and Failure.
6. Open Audit Logoff and enable Success.
7. Navigate to:
   Security Settings → Local Policies → Security Options and enable Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings.
8. Close the Group Policy Management Editor.
9. On the target computer, run:

   gpupdate /force

10. Verify the effective configuration:

    auditpol /get /category:*

    
    Confirm that Audit Logon and Audit Logoff display the intended settings.

Important: If the article also needs to explain domain authentication monitoring, add a short note recommending a dedicated domain controller GPO for Kerberos Authentication Service and Credential Validation auditing.

Step 2 – Search Relevant Event IDs in Event Viewer

After enabling logon and logoff auditing through Group Policy, Windows records relevant events in the Security log of the computer where the activity occurs. You can use Event Viewer to identify successful and failed logon attempts, determine when a user logged on, and review logoff activity.

Follow these steps to check user login history:

1. Press Windows + R, type eventvwr.msc, and press Enter to open Event Viewer on the target computer.
2. In the left navigation pane, expand Windows Logs and select Security.
3. In the right-hand Actions pane, click Filter Current Log.
4. In the Event IDs field, enter 4624,4625,4634,4647,4648 and click OK.
5. Review the filtered events to identify successful logons, failed attempts, and logoff activity.
6. Double-click an event to view its details, including the account name, event timestamp, Logon Type, and source network address where available.

The following table explains the relevant Windows Security Event IDs.

How to Identify the Type of User Logon

When reviewing Event ID 4624, check the Logon Type field to determine how the user accessed the computer. Not every successful logon event represents an interactive user sign-in.

For identifying when users signed in locally or through Remote Desktop, focus primarily on Logon Types 2, 10, and 11. Logon Type 7 can help identify when an existing session was unlocked.

How to Interpret Logon and Logoff Events

Event ID 4624 indicates that a successful logon session was created. The event’s Logged timestamp shows when Windows recorded the event.

To investigate when a session ended, look for Event ID 4634 or 4647. Where available, use the Logon ID to correlate events on the same computer. However, a session ending, a user initiating logoff, and a Remote Desktop session disconnecting are not necessarily the same activity.

Event ID 4648 provides additional information about attempts to use explicit credentials, such as when an account is used to run a process under different credentials.

Note: Review these events on the target workstation or server. Domain controller Security logs provide separate domain authentication information and do not necessarily contain a complete record of interactive logon sessions on every domain-joined computer.

Limitations of Native Windows Logon Auditing

Native Windows auditing provides valuable information about successful and failed logon attempts, but administrators should understand several limitations:

• Distributed logs: Logon events are recorded on individual computers, requiring administrators to review multiple systems unless logs are centrally collected.
• High event volume: Windows generates logon events for interactive sessions, network access, services, and automated processes.
• Limited historical visibility: Older events may be overwritten when Security logs reach their configured size, depending on retention settings.
• Session correlation: Determining when a user logged on and logged off may require correlating multiple events using Logon IDs and considering disconnects, unlocks, and system restarts.
• Incomplete domain-wide visibility: Domain controller authentication events alone cannot reliably reconstruct every interactive workstation session.

Check User Login History with Lepide’s Free Tool for AD Auditing

Using Lepide Change Reporter for AD, you can easily monitor AD users’ login history by tracking their logon and logoff activities in real-time. The solution collects log on information from all added domain controllers automatically. Its report contains details on logon or logoff events, including when users logged in, from which computer, and when. You get accurate and instant reports on the login details of users in the network. The following screenshot shows a successful user logon report event captured by Lepide’s free tool::

Lepide Change Reporter provides following reports related to logon/logoff:

Report Name	Description
Successful User Logon/Logoff	It shows all direct logon and logoff attempts performed on all computers in a domain.
Failed Logon	It shows all failed logon attempts done within the domain.
Domain Controller Logon/Logoff	It shows all logon/logoff activities done by the users on the domain controllers
User Logged on Multiple Computers	It shows the list of users logged on more than one computer
Concurrent Logons	It shows the successful logons made by a user concurrently on to the different computers.

Frequently Asked Questions