> ## Content Index
> Fetch the complete content index at: https://www.filipkonopik.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# PowerShell: Find Successful Login Events in Event Log
- URL: https://www.filipkonopik.com/powershell-find-successful-login-events-in-event-log/
- Published: 2026-07-26T17:19:31.000Z
- Updated: 2026-08-06T05:40:13.000Z
- Author: Filip Konopík
- Tags: Event Logs & Monitoring

Need to check successful login events - for security auditing, confirming when a user last logged in, or building a login history? This one-liner searches the Security log directly for the relevant event.

Prerequisites:

- Privileges: Run as Administrator
- Module: Built-in, no import needed

Quick Command:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 5
```

Example Output:

```powershell
ProviderName: Microsoft-Windows-Security-Auditing
TimeCreated                      Id LevelDisplayName Message
-----------                      -- ---------------- -------
7/26/2026 9:15:32 AM            4624 Information      An account was successfully logged on...
```

📦

****Want all of them at once?**  
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.

[Get the Complete Bundle for $39](https://gum.co/u/oczvkqdc?ref=filipkonopik.com)

How It Works:

- Get-WinEvent -FilterHashtable filters the Security log for a specific Event ID instead of returning everything, which is far more efficient than pulling all events and filtering afterward.
- Id=4624 is the specific Windows Event ID for a successful logon - it fires every time any account (local, domain, or service) successfully authenticates on the machine.
- \-MaxEvents 5 limits the output to the 5 most recent matches, since this event can fire frequently and generate a lot of entries over time.