How to check last login in Windows 11 and 10 (4 ways)

Applies to: Windows 11 and Windows 10, all editions. Method 4 is for work PCs that sign in to an Active Directory domain.

Method 1: Use the net user command

This is the quickest way to see the last sign-in for one local account.

1. Press Windows, type cmd and press Enter.
2. Type net user and press Enter to list the account names on this PC.
3. Run net user followed by the account name, for example:

net user Alex

Look for the Last logon line. If the name has a space in it, put it in quotes: net user "Home User". Never means the account has not signed in on this PC since it was created.

If you use a Microsoft account, the name to use is the short local name, which is usually the same as your folder under C:\Users, not your email address. If you want to change that name, see how to change the user name in Windows 10.

Note: Last logon only gives the most recent sign-in, and unlocking a locked PC may not always update it. For a list of sign-ins with exact times, use Event Viewer.

Method 2: Check Event Viewer

Windows records each successful sign-in in the Security log as event 4624, and each failed attempt as 4625.

1. Right-click Start and select Event Viewer. Sign in as an administrator if asked.
2. In the left pane, open Windows Logs > Security.
3. In the right pane, select Filter Current Log.
4. In the box that says <All Event IDs>, type 4624 and select OK.
5. Select an event and read the General tab. Under New Logon, Account Name is the account that signed in. Near the top, Logon Type tells you how (see the table below).

Expect a lot of entries: Windows services sign in as SYSTEM and other built-in accounts all the time. Ignore those and look for your own account name with logon type 2, 7, 10 or 11. To see failed password attempts instead, filter for 4625.

Method 3: Use PowerShell

Open Windows PowerShell or Terminal as administrator (right-click Start and choose Terminal (Admin) or Windows PowerShell (Admin)). To list every local account with its last sign-in:

Get-LocalUser | Select-Object Name, Enabled, LastLogon

To list the last 15 real sign-ins from the Security log, with the account name and logon type, filtering out service sign-ins:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 500 |
  Where-Object { $_.Properties[8].Value -in 2,7,10,11 } |
  Select-Object -First 15 TimeCreated,
    @{n='User'; e={$_.Properties[5].Value}},
    @{n='LogonType'; e={$_.Properties[8].Value}}

The command checks the newest 500 sign-in events. On a busy PC, raise -MaxEvents if it returns too few results. Get-LocalUser is built into Windows PowerShell 5.1; if it isn’t recognised in PowerShell 7, run it in Windows PowerShell instead.

Method 4: Check a domain account

On a work PC joined to a domain, net user username only shows local accounts. Add /domain to ask a domain controller instead:

net user username /domain

The result comes from one domain controller, so it may not reflect a sign-in handled by another. Your IT team can get an exact answer from Active Directory. The Event Viewer method above still works for sign-ins on this particular PC. If domain sign-in itself is failing, see the trust relationship between this workstation and the primary domain failed.

How to read logon types

Each 4624 event has a Logon Type number. These are the ones that mean a person signed in:

Logon type	What it means
2	Signed in at the PC with the keyboard (interactive)
7	Unlocked the PC after it was locked
10	Signed in over Remote Desktop
11	Signed in with cached credentials, for example a domain laptop away from the office
3	Accessed the PC over the network, such as a shared folder
5	A Windows service started; not a person

If you find type 10 sign-ins you don’t recognise, someone may be using Remote Desktop on your PC. Change your password, turn Remote Desktop off in Settings > System > Remote Desktop if you don’t use it, and scan for malware.

If no sign-ins are recorded

Windows logs successful sign-ins by default on most PCs, but an administrator or a security tool can turn this off. On Windows Pro, Enterprise and Education, check the setting in Local Security Policy:

1. Press Windows + R, type secpol.msc and press Enter.
2. Go to Local Policies > Audit Policy and open Audit logon events.
3. Tick Success (and Failure if you want failed attempts) and select OK.

On a work PC, these settings usually come from Group Policy and may be managed by your IT team. Windows Home doesn’t include secpol.msc; you can check the current settings with auditpol /get /category:"Logon/Logoff" in an administrator Command Prompt. Also note that the Security log has a size limit, so older events are overwritten as new ones arrive.

Sign-ins to your Microsoft account on websites and other devices are a separate record: you can see them under recent activity in your Microsoft account’s security settings online. If an account keeps getting locked by failed attempts, see the referenced account is currently locked out.

Related guides

• The referenced account is currently locked out: how to fix it
• How to change the user name in Windows 10
• How to run as a different user in Windows 11
• The trust relationship between this workstation and the primary domain failed
• How to scan for malware in Windows

Official sources: for more detail, see these Microsoft pages:

• Microsoft Learn: 4624(S) An account was successfully logged on
• Microsoft Learn: Get-LocalUser

Frequently asked questions

How can I see who logged into my computer and when?

Open Event Viewer, go to Windows Logs > Security and filter for event ID 4624. Each event shows the account name, the time and the logon type. The PowerShell command in Method 3 gives a shorter list of just the sign-ins made by people.

Can I check the last login without admin rights?

Partly. A standard user can usually run net user username to see the Last logon time, but reading the Security log in Event Viewer or with PowerShell needs an administrator account.

Does Windows record failed login attempts?

Yes, when failure auditing is on. Failed sign-ins are logged as event 4625 in the Security log; the event shows the account name that was tried and a failure reason.

Why does net user say Last logon Never?

The account hasn’t signed in on this PC since it was created, or you’re looking at a local account when the person signs in with a domain account. For domain accounts, add /domain to the command.