In this guide we will see how to find out if someone has used our PC running Windows 10, 8 or 7 when we were absent without our permission, including the date, the exact time of access and the last files opened.
The keyboard is out of place. Someone left some leftovers on the table. Your monitor is tilted in a strange corner … You know someone has used your PC, but we don’t have the proof.
Some colleagues in the office, a roommate, our partner or any other person who could have access to the PC could use our computer without our authorization and even access the confidential personal information contained therein, at best, you’ll see some new or moved files or changes in browsing history…
Although we are the only ones using our computer, it is always convenient to access the system with a password, but the truth is that someone might have seen us typing it on several occasions. In this way, he would have access to our computer with our username and password freely.
In any case, we can use some Windows functions to know at what time of the day there were accesses to the system, that is when the PC was used. This way you will know if you only used the computer yourself or if someone turned it off recently.
But how do I know if someone has used my PC? The truth is that the person who used the computer not only left the crumbs as proof of their presence on the desktop but also left the crumbs on your computer without realizing it. No matter what they did on your PC, the truth is that almost everything that is done on a computer leaves a sort of story.
In fact, some obvious signs are left if someone has used our computer. Furthermore, we can count on some tricks to get more information about it.
Check the Event Viewer in Windows 10
To find out when your PC was used, we’ll use the Windows Event Viewer tool. You’ll find it in virtually all current versions of Windows, from XP to 10, and also on Vista, 7, 8 and 8.1.
You will find the Event Viewer in Control Panel> System and Maintenance> Administrative Tools or by opening it directly from the Run menu, activated by the Windows + R key combination and typing eventvwr.msc.
Event Viewer provides information on everything that happens in our operating system, such as when some Windows services are run, when this or that application is installed or uninstalled…
In this case, we ask Windows when the PC was used. To do this, in the Event Viewer, we will go to Windows Logs> System from the left side panel.
Once there, we will see that a list of items is shown in the central panel. Since this information is mixed, we will have to filter it to get only what we are looking for.
From Actions> System (right side panel), click Filter current record… and a new window will open. In the field All event ids we will indicate the following numbers- 1, 12, 13, 42.
These event ids refer to when windows came out of the suspension (event 1) when the PC was turned on (event 12), when we turned off the PC (event 13) and when the computer was suspended or hibernated (event 42).
With this information, we will see what time of day we turned on the computer, turned it off, put the computer in suspension (or did it automatically because we weren’t using it), etc.
Once you have filtered the information displayed in Windows Logs> System, we can see the dates and times and the type of event based on the ID (active, deactivated, etc.).
From here, we can understand whether in those moments of the day we were in front of our computer or not .
With this information, you can be sure of knowing when your PC was used and knowing if your suspicions were founded or created only by your imagination. Furthermore, it is possible to save a file that shows that data.
Obviously, the Event Viewer has its limitations, although the information shown is reliable and complete. Among other things, it will show you the user who has accessed the dates and times shown. This way you will know if someone knows your password or if you simply log in with your user account.
