PowerShell: Find Successful Login Events in Event Log
Need to check successful login events - for security auditing, confirming when a user last logged in, or building a login history? This one-liner searches the Security log directly for the relevant event.
Prerequisites:
- Privileges: Run as Administrator
- Module: Built-in, no import needed
Quick Command:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 5Example Output:
ProviderName: Microsoft-Windows-Security-Auditing
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
7/26/2026 9:15:32 AM 4624 Information An account was successfully logged on...📦
Want all of them at once?
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
How It Works:
- Get-WinEvent -FilterHashtable filters the Security log for a specific Event ID instead of returning everything, which is far more efficient than pulling all events and filtering afterward.
- Id=4624 is the specific Windows Event ID for a successful logon - it fires every time any account (local, domain, or service) successfully authenticates on the machine.
- -MaxEvents 5 limits the output to the 5 most recent matches, since this event can fire frequently and generate a lot of entries over time.