How to check your computer's activity history?
Many users do not have the habit of setting a password for their computer, especially when working in an office. However, this also causes some troubles because strangers can access your computer without permission to steal information or use your computer for other purposes.
If you suspect someone has accessed and used your computer without permission, you can apply some of the following tricks to check the history of turning on/off the machine, view recent activities on the machine to confirm and reaffirm that.
Check history on Windows computers
1. Check recent activities in “Jump Lists”
If you notice, you will see that the current new versions of Windows 10 no longer display the list of recent activities on the system (except for newly installed applications) in the Start menu as before. (Move to the next section below if you are running on an old Windows 10 release, or previous versions of Windows).
However, you can still easily check the list of files that have been recently accessed on the system just by right-clicking on the applications in the Start menu as well as the taskbar.
For example, do you want to check if someone has secretly opened your Word document? Launch the Microsoft Word application, open any document, then right-click on its icon on the taskbar and look at the “Recent” part in the context menu that appears. Here, you will see a complete list of document files that have been recently opened on Microsoft Word, thereby easily detecting any abnormalities if someone has secretly viewed your document.
You can do the same in the Start menu. Right-click on any application that you think someone may have recently accessed, including web browsers. However, if you have set the browser to automatically delete web browsing history, there will be nothing to display.
Also, you can open File Explorer and view the list of files that have been recently accessed in the “Quick Access” section.
However, if this setting is not enabled by default, you will have to manually activate it by navigating to “Start -> Settings -> Personalization -> Start”.
Click the switch on the left of the option “Show recently opened items in Jump Lists on Start or the taskbar and in File Explorer Quick Access” to turn it on.
2. Check the Recent Activity list (older versions of Windows 10 and previous Windows generations)
On Windows 10, press Windows + E to open File Explorer, here you will see images, zip files, txt, Word, Excel, PowerPoint files that have been opened.
On Windows 7, click on the Start Menu, and you will see a list of all the programs that have been opened recently and if there is a strange program or one you did not use before appearing in this list then it is likely that someone has opened your computer. Hover over the Recent Items section on the right side of the Start Menu, you will see a list of files that have been opened recently.
However, the limitation of this solution is if the unauthorized computer access person is smart enough, they can delete recent activities and delete recently opened files, so it's hard for you to detect whether your computer has been accessed and used by someone else or not?
3. Check the Windows Event Viewer
Windows will store a full list of successful as well as failed logins. You can take advantage of this point to check if someone has accessed your computer or not?
To view successful or failed logins, access Windows Event Viewer.
To access Windows Event Viewer, first press the Windows + R key combination to open the Run command window, then enter eventvwr.msc into it and press Enter or click OK to open the Event Viewer window.
Here you double-click on the Windows Logs button, then click on Security. In the middle of the list, you will see the login times along with the date and time of login. Each time you log in, Windows will record the logins during the previous period of about 2 to 4 minutes.
In addition, you can specifically check the account that accessed your computer before (in case there are multiple accounts). To check, double-click on a specific login, at this point the Event Properties window will appear on the screen. And you will see the account name next to Account Name.
4. Display details of the last login
The last solution you can think of is to set up displaying detailed login information when the computer starts. This operation will display the account you used in the last login, whether successful or failed.
You will have to edit the Windows Registry, so before proceeding you should first create a backup.
Press the Windows + R key combination to open the Run command window, then enter regedit into the Run command window and press Enter or click OK to open the Windows Registry.
In the Registry Editor window, navigate to the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Next, right-click on the System folder select New => DWORD value to create a new DWORD and name this DWORD as DisplayLastLogonInfo.
Double-click on DisplayLastLogonInfo and set the value in the Value Data box to 1.
From now on, whenever you log into the computer, you will see detailed information about the last login and any failed login attempts.
5. Activate Logon Auditing
Note: Logon Auditing only works on the Professional version of Windows 7, 8, and Windows 10 and does NOT work on the Home version.
To activate Logon Auditing, first open the Local Group Policy Editor. Press the Windows + R key combination to open the Run command window, then enter gpedit.msc into it and press Enter to open the Local Group Policy Editor.
Local Computer Policy => Computer Configuration => Windows Settings => Security Settings => Local Policies => Audit Policy
Or another way is to enter gpedit.msc into the Search box on the Start Menu and press Enter.
Next in the Local Group Policy Editor window, navigate to the key:
Double-click on the Audit logon events policy setting in the right pane to adjust the option.
Next in the Properties window, check the box for Success to display successful logins. Additionally, you can check the box for Failure to display failed login attempts.
6. Check recently used files
To check recently used files, open any application you use frequently and check the Open recent (or similar) option in the File menu. Not every application has this option, but it will show the user the files that have been opened recently, searching for files that you do not recognize.
You can also search for files that have been modified on specific dates. Open a window and enter a related word on the left side of the window, then select the Date modified option and choose a date on the calendar that appears.
Windows will then search for all files in the Library folder that were changed on that day. You can do the same in the C: drive but Windows changes many files for normal use purposes, so this action may not yield the same results.
7. Check web browser history
Finally, don't forget to check your web browser history. It will display a list of all the websites that have been opened recently and browsed by date. But one thing you need to keep in mind is that web browsing history can be easily deleted but you can completely trace the deleted web browsing history.
The best way to prevent someone from using your computer is to set a Windows user account password. Then whenever you leave the computer but do not want to turn it off, press Windows
Afterward, whenever you leave your computer but don't want to turn it off, press Windows + L to lock the screen.
Check activity history on Mac
On computers using the Mac OS operating system, you can only check if someone has used your computer when you're away and it's in Sleep mode, meaning it only records the activities that wake the computer from Sleep mode. You can follow these steps:
Open the Console dialog by pressing Command + Spacebar, or click on the Spotlight icon and search for it. Type "wake" into the search bar, then scroll to the bottom of the list, where you will find the most recent login activities.
A few simple, but effective tricks to check who has been using your computer when you're not there. This is quite useful for monitoring your children's or younger siblings' computer usage, however, in other cases, you should set a password for your computer to ensure safety.
