How to View User Actions on a Windows PC

Read more about the information on user activities saved by Windows and how to view it, and about checking a user’s online activity. As many people know, and we also wrote about it in our blog, online privacy is a very relative thing. While using the Internet, every user leaves their trace in search engines that remember search queries and browsing history, watch history on YouTube, and sometimes even user geodata. In this respect, using social media has similar effects. By default, Internet browsers have their functions for saving browsing history, logins and passwords, as well as autofill data turned on.

How to View User Actions on a Windows PC

In today’s article, you’ll see what information about user activity Windows can save, and how to view this data.

Go to view
How to View Browsing History for Google Chrome, Mozilla Firefox, Opera, Edge, Internet Explorer  🌐⏳💻

How to View Browsing History for Google Chrome, Mozilla Firefox, Opera, Edge, Internet Explorer 🌐⏳💻


Go to view
How to View User’s Logins and Passwords Saved in a Browser for Facebook, Twitter, Instagram 🕵️🔍🔐

How to View User’s Logins and Passwords Saved in a Browser for Facebook, Twitter, Instagram 🕵️🔍🔐

Browsing History

If you want to know if anyone used the computer and the Internet while you were away, the first and the easiest way to check it is to view browsing history.

There is a special article on this topic.

Browsing History

Search Engines

To find a website, a webpage, a video or any other information on the Internet you need two things: an Internet browser and a search engine. Both tools can store browsing history, watch history (talking of YouTube), search history and search queries, and some tools can also save comments and posts in various online communities.

That is why the next way to view a user’s online activity is to check their activities in online accounts of various search engines.

Find a detailed article about it here.

Search engines

Go to view
How to Clear Browsing History and Cache in Chrome, Yandex, Opera, Firefox, Edge 📝🔥🌐

How to Clear Browsing History and Cache in Chrome, Yandex, Opera, Firefox, Edge 📝🔥🌐

Recycle Bin

Now let’s move from online activities to what users can do in Windows. We recommend checking the Recycle Bin as the first step. All the files deleted from this computer end up there.

To see if any files were deleted from the computer while you were away, open the Recycle Bin and select “Details” view option.

Recycle Bin

After that, sort the files by date of deleting, by clicking on the “Date deleted” heading. As a result, you can see files deleted recently.

Go to view
How to Recover Files Deleted From Windows Recycle Bin or With Shift + Del 📁🔥⚕️

How to Recover Files Deleted From Windows Recycle Bin or With Shift + Del 📁🔥⚕️

File Modification Date

In Windows, you can sort files in every folder by the date when they were modified. Even if you don’t know where to look for files that could be modified without your knowing it, or while you were away, Windows has a good option for you.

Start the Run tool by right-clicking on the Start menu or pressing the shortcut Win + R.

Start / Run

In the field “Run,” enter the command recent and click OK.

Run: Recent

A folder containing recently modified files will open, with the files being sorted chronologically, beginning with the latest changed files.

Recent. A folder containing recently modified files

Downloads

By default, all browsers save files from the Internet into the system folder “Downloads.” Go to this folder, and sort the files by download date, so you can see the latest files downloaded to this computer. There might be some stuff which you did not download, but someone else did…

Downloads Folder

If the browser default folder for downloads has been changed, you should check it too.

Sorting Programs by Date Modified

All programs on the computer are started with executable files having the “.exe” extension. To learn the date and time when a program was started:

  • Open the folder “This computer” and enter “.exe” in the search field. As a result, the search window will show you all files with this extension type on this computer.

    Open the folder “This computer” and enter “.exe” in the search field
  • Right-click on the heading of any column, and select “Details”

    Right-click on the heading of any column, and select “Details”
  • The window to choose columns will open. Find the line “Date modified”, check the box next to it and click OK.

    The window to choose columns will open. Find the line “Date modified”
  • A new column called “Date modified” will appear in the search results window.

    A new column called “Date modified” will appear in the search results window

Now you can see the date when this or another program was started on this computer. If you don’t understand what program is hiding behind a particular .exe file, you can check it in Location column, or even start the program right from the search results window.

Windows Logs

In Windows logs, the operating system records and saves all events, registers errors, information messages and warnings from applications, as well as the information on user activity and work of the operating system.

Go to view
Windows Event Viewer: How to View Information about Errors in Windows 7, 8, 10 💥📜💻

Windows Event Viewer: How to View Information about Errors in Windows 7, 8, 10 💥📜💻

To go to Windows Logs, open Control Panel / Administrative Tools / Computer Management.

To go to Windows Logs, open Control Panel / Administrative Tools / Computer Management

In Computer Management, go to System Tools / Event Viewer / Windows Logs.

In Computer Management, go to System Tools / Event Viewer / Windows Logs

Logs are arranged by category. For example, application logs can be found in Application category, and system logs – in System category. If the computer has security events monitoring enabled, for example monitoring for logging in, then events are registered in the Security category.

Certainly, the information shown in Windows Logs are meant for system administrators, and ordinary users will have difficulty understanding it. Nevertheless, if you look at it more attentively, in the Application log you can see events generated by applications arranged in a sort of chronological order.

Computer Management

There is also some data on the date and time of logging in and off the operating system. In other words, it means the time when the computer was turned on or off. You can find this information in Security and System logs.

Task Scheduler and Attaching Tasks to Events

Using Windows Logs, you can attach executing a task to a certain event in the log. For example, you can set up the computer to send a message to your email address every time your account logs on in Windows.

For example, I have an event in the Security log at logon. Its code is 4624. To attach a task to an event, right-click on the event and select “Attach task to this event.”

To attach a task to an event, right-click on the event and select “Attach task to this event.”

Then follow the steps in the Basic Task Wizard, and in the line “Action” select “Send an e-mail.”

In the line “Action” select “Send an e-mail.”

Enter the addresses where to send the message, the theme and text, and then the SMTP server for your mail service.

Enter the addresses where to send the message

Similarly, you can create a task attached to an event by using Task Scheduler. To do it, go to Task Scheduler and select “Create Basic Task…”

Go to Task Scheduler and select “Create Basic Task...”

Set up the task by using the same Basic Task Wizard.

Set up the task by using Basic Task Wizard

The picture shows how to set up the computer to send a message to your email address every time your account logs on in Windows, but in a similar way, you can set up the computer to perform other tasks attached to any event in the system log.

Vladimir Artiukh

Author: , Technical Writer

Vladimir Artiukh is a technical writer for Hetman Software, as well as the voice and face of their English-speaking YouTube channel, Hetman Software: Data Recovery for Windows. He handles tutorials, how-tos, and detailed reviews on how the company’s tools work with all kinds of data storage devices.

Oleg Afonin

Editor: , Technical Writer

Oleg Afonin is an expert in mobile forensics, data recovery and computer systems. He often attends large data security conferences, and writes several blogs for such resources as xaker.ru, Elcomsoft and Habr. In addition to his online activities, Oleg’s articles are also published in professional magazines. Also, Oleg Afonin is the co-author of a well-known book, Mobile Forensics - Advanced Investigative Strategies.

Recommended For You

Hello! This is AI-based Hetman Software virtual assistant, and it will answer any of your questions right away.
Start Chat