Enable Logon Event Auditing

• Hold the Windows key and press R (WIN+R) to open the run dialog function.
• Enter gpedit.msc then select OK. This will open the ‘Local Group Policy Editor’ window.
• In the left pane, expand the tree to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy.
• Double-select Audit logon events.
• To enable auditing of both successful logins and unsuccessful logins, select both checkboxes.
• Select Apply and OK.