How to Track the Activity of Others on Your Windows Computer

Unauthorized Users Featured Image

Have you ever caught someone lurking near your computer looking guilty? Is your child using your computer to avoid the parental controls you have set up? Whether you’re afraid of the theft of your personal information or your child participating in dangerous activities on the Web, you can find out what people are doing behind your back by trying some of these actions.

Windows Events

Your computer keeps track of all the activity. Finding times when the computer was in use is a first step to seeing if someone else was using it.

1. Type “event viewer” into the Start menu.

2. Open it by clicking on Open.

Unauthorized Users Event Viewer

3. Expand the Windows Logs folder.

Unauthorized Users Event Viewer Window

4. Click on System to select it and then right-click on it.

Unauthorized Users Filter Current Log

5. Double-click on “Filter Current Log.”

6. Open the Event sources drop-down list.

7. Scroll down until you see the “Power-Troubleshooter” option. Click the checkbox next to it.

Unauthorized Users Power Troubleshooter

8. Click OK.

The Windows Event Viewer will display the times your computer was turned on or brought out of sleep mode. If these times don’t match your usage, someone has been using your computer.

Unauthorized Users Bootup Times

Recent Files

Using Windows Events will tell you someone else was using your computer but not what they were doing. That requires a little more digging. One way to get started is to look for recently-opened files.

Find unusual documents by opening a Windows Explorer dialog box and performing a search for documents created when someone else used the machine.

1. Open a Windows Explorer window and right-click on This PC.

2. Click in the Search box in the upper-right corner. You don’t have to type anything. Clicking in this box lets your computer know you want to search.

3. Go to the menu and click on the Date Modified search filter icon.

Unauthorized Users Date Modified

4. Choose the day or period you want to explore.

Unauthorized Users All Modified Files

If you don’t want to wade through all the app and browser data in that list, you can find the recently-created documents with Windows Explorer, too.

1. Open a Document dialog box.

2. Click on Quick Access at the top of the list.

3. You’ll see a list of the twenty most recent documents and folders someone has accessed.

Unauthorized Users Recent Files

4. Look through the files and folders to look for anomalies.

Recently Deleted Files

If the unauthorized user tried to delete the data they accessed or changed, they could still be in the Recycle bin. If the intruder was a little savvier, they might have emptied the bin to hide the evidence.

Even if the person deleted the files, you could still see what they accessed with a free data recovery program such as Recuva. It finds all deleted files as long as your machine has not permanently overwritten them.

Web History

Another place to find information on what the unauthorized user did is browser history. Although someone well-versed in technology may know ways around this, it doesn’t hurt to check.

In Google Chrome, click the three vertical dots in the upper-right corner. Hover over History and look at the sites that someone visited. You can also see this information by using Ctrl + H.”

In Firefox, click on the “View history, saved bookmarks and more” icon to the left of the address bars. It looks like a stack of books in a library. Then click History.

Unauthorized Users Firefox History

Microsoft Edge has a Hub icon in the top-right of the window. It looks like a shooting star. Click on the icon and then click on History.


If you are sure someone has been intruding into your private files and you want to catch them, you could try a keylogger program. These programs monitor keyboard activity and log everything that has been typed. One free option you could try is Revealer.

Because people use keyloggers for malicious reasons, it will probably be quarantined by your anti-malware, even though you are only using it on your own computer. You’ll need to remove that quarantine before you can use it.

How to stop others from using it

It’s always best to be proactive and avoid this problem before it happens. Set a password on your Windows account. Choose something strong and unusual but easy for you to remember.

To change or set your password:

1. Click the Start button.

2. Choose Settings by clicking on the gear icon.

Unauthorized Users Settings Icon

3. Select Accounts.

Unauthorized Users Accounts

4. Select Sign-in options from the menu.

Unauthorized Users Signin Options

5. Click on Password and then Change.

6. To change your password, sign in with your current Microsoft account password. Enter your password in the box. Click “Sign in” and follow the directions from Microsoft to access your account and create the password.

Unauthorized Users Change Password

Once you set the password, lock your computer by pressing Ctrl + l whenever you are away from it.

You can’t be too careful with the personal information on your computer, so if you suspect someone may be using your machine, try some of the tips shared in this article for evidence.

Tracey Rosenberger Tracey Rosenberger

Tracey Rosenberger spent 26 years teaching elementary students, using technology to enhance learning. Now she's excited to share helpful technology with teachers and everyone else who sees tech as intimidating.