>

Show Recent Windows Logon Events (Security event 4624)

List the latest successful sign-ins recorded in the Windows Security event log with PowerShell.

Windowssecuritypowershellevent-logLow risk
Run Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 10 and read the TimeCreated and Account columns.

01Command

Command
$ Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 10 | Select-Object TimeCreated, @{n='Account';e={$_.Properties[5].Value}}, @{n='Type';e={$_.Properties[8].Value}}

02What it does

Every successful sign-in — local keyboard, RDP, network and service logons — writes a 4624 event to the Security log, and this query pulls the newest ten. The Logon Type field tells you how: 2 is interactive (someone at the keyboard), 10 is Remote Desktop, 3 is a network share access. Regular 4624 entries at odd hours for accounts you do not recognize are worth investigating.

03Risk

RiskLow risk
RequirementsRun in an elevated (Administrator) PowerShell — the Security log is readable only by admins
!Warning: The Security log fills with system/service logons too, so filter by the Account column to see human logins only.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • 4624(S): An account was successfully logged on
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Defines Windows security event 4624 for successful logons and documents its fields, including Account Name (index 5) and Logon Type (index 8).

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Verify Code Signatures with Get-AuthenticodeSignature
Windowssignaturesecuritypowershell

Read the Authenticode signature status and signer of any executable or script in PowerShell.

Low risk ✓ 2026-09-17
Fix 'scripts is disabled on this system' with Set-ExecutionPolicy
WindowsTerminaldevelopersecurity

Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.

Medium risk ✓ 2026-09-17
Grep on Windows: Select-String
Windowssearchtextpowershell

Search inside text files and logs with regex, returning file, line number and match.

Low risk ✓ 2026-09-17