Date/Time someone last logged in viewable in XP?


Sep 25, 2006
Hi there ;)

I asked the following question about a couple hondred times already on forums in my native language (dutch)
But I never got any answers. I was hoping people here were more knowledgeable and could help me out.

Is it possible in WinXP, to see when and who (user, incl date and time)
last logged in ?
It would be a big plus to my system. I hope this is in fact possible and that
this information is already stored and viewable for the past few days.
I am the sole administrator to this system and ask this because of a possible security problem.

I tried looking in event-manager already, but I only see
cryptic messages that didnt make any sense to me. So I couldnt find any
useable infromation.

Please. I really believe there has been unauthorized access to my PC.
And I just need dates and time to see if access occured when I was in fact away myself.

Please help.
Thank for any helping comments in advance ;)


Jan 31, 2006
If you can't find this information, an alternative would be to clear your Recent Folder under Documents Settings any User Names as well as cleaning your Web Browser(s) Cache, Internet History, and Cookies before you shut the machine down. When you next log in, check to see if there is anything in these folders. At least you'll know if someone is accessing your machine and what they're doing.


Sep 25, 2006
Thanks for your reply.

I only think it would be more reliable if windows would make some log-entry wich says who/or when and at what time someone logged in.

After all windows has been through in development and all it isc apable of,
I kinda refuse to believe windows does not log cricial informtian as simple as this.

BTW. I think my topic would ve been best under admin/security orso..
Can a Mod move this topic for me?

Thanks ;)


goto run, type mmc hit enter.
Goto File - add/remove snap-in
Click Add. Scroll down and select group policy object editor. click add, finish, close. then ok.
click + sign by local computer policy
click + by computer configuration
click + by windows settings then security settings then local policies and finally click on audit policy:
In there you can audit the success or failure of logins and other things.

Be warned though that messing with the group policy could lock you out of the computer or programs. But its a nice thing to learn if you want to lock your computer down.