查看windows登陆日志

By default, most versions of Windows record an event every time a user tries to log on, whether that log on is successful or not. You can view this information by diving into the Event Viewer, but there’s also a way to add information about previous logons right on the sign in screen where you can’t miss it. To make it work, you’re going to have to dive into the Windows Registry or, if you have a Pro or Enterprise version of Windows, the Group Policy Editor. But don’t worry. The changes are pretty simple and we’ll walk you through them.

默认情况下，大多数版本的Windows都会在用户每次尝试登录时记录一次事件，无论该登录是否成功。 您可以通过进入事件查看器来查看此信息，但是还有一种方法可以直接在登录屏幕上添加有关先前登录的信息，而您不会错过它。 要使其正常工作，您将不得不进入Windows注册表，或者，如果您具有Windows的Pro或Enterprise版本，则必须进入组策略编辑器。 但是不用担心。 更改非常简单，我们将逐步引导您。

This technique works in every version of Windows from Vista on up, but of course there are a couple of caveats. The first is that, in Windows 8 and 10, this trick only works with local accounts, not Microsoft accounts. If you have both types of accounts on one computer, you can still use this technique, but it will only display information when you sign in with a local account. The second caveat is that if you have Windows set up to log on automatically, you won’t see the extra screen with logon info.

这项技术适用于Vista以上版本的Windows的所有版本，但是当然有一些警告。 首先，在Windows 8和10中，此技巧仅适用于本地帐户，不适用于Microsoft帐户 。 如果您在一台计算机上同时拥有两种类型的帐户，则仍可以使用此技术，但是仅当您使用本地帐户登录时，它才会显示信息。 第二个警告是，如果您将Windows设置为自动登录 ，则不会看到带有登录信息的额外屏幕。

家庭用户：通过编辑注册表显示以前的登录信息 (Home Users: Show Previous Logon Information by Editing the Registry)

If you have a Windows Home edition, you will have to edit the Windows Registry to make these changes. You can also do it this way if you have Windows Pro or Enterprise, but just feel more comfortable working in the Registry as opposed to Group Policy Editor. (If you have Pro or Enterprise, though, we recommend using the easier Group Policy Editor, as described in the next section.)

如果您使用的是Windows Home版本，则必须编辑Windows注册表才能进行这些更改。 如果您使用的是Windows Pro或Enterprise，也可以通过这种方式进行操作，但是与组策略编辑器相比，在注册表中工作更加自在。 (但是，如果您具有Pro或Enterprise，我们建议使用更简单的组策略编辑器，如下一节所述。)

Standard warning: Registry Editor is a powerful tool and misusing it can render your system unstable or even inoperable. This is a pretty simple hack and as long as you stick to the instructions, you shouldn’t have any problems. That said, if you’ve never worked with it before, consider reading about how to use the Registry Editor before you get started. And definitely back up the Registry (and your computer!) before making changes.

标准警告：注册表编辑器是一个功能强大的工具，滥用它会使您的系统不稳定甚至无法运行。 这是一个非常简单的技巧，只要您按照说明进行操作，就不会有任何问题。 也就是说，如果您以前从未使用过它，请在开始之前考虑阅读有关如何使用注册表编辑器的信息 。 并在进行更改之前一定要备份注册表 (和您的计算机 ！)。

To get started, open the Registry Editor by hitting Start and typing “regedit.” Press Enter to open Registry Editor and give it permission to make changes to your PC.

首先，点击开始并键入“ regedit”，打开注册表编辑器。 按Enter键打开注册表编辑器，并授予其对PC进行更改的权限。

In the Registry Editor, use the left sidebar to navigate to the following key:

在注册表编辑器中，使用左侧边栏导航至以下键：

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

Next, you’re going to create a new value inside that System subkey. Right-click the System icon and choose New > DWORD (32-bit) Value. Name the new value DisplayLastLogonInfo.

接下来，您将在该System子项中创建一个新值。 右键单击“系统”图标，然后选择“新建”>“ DWORD(32位)值”。 将新值命名为DisplayLastLogonInfo 。

Next, double-click the new DisplayLastLogonInfo value to open its properties window. Change the value from 0 to 1 in the “Value data” box and then click OK.

接下来，双击新的DisplayLastLogonInfo值以打开其属性窗口。 在“数值数据”框中将数值从0更改为1，然后单击“确定”。

You can now close the Registry Editor. The next time you sign in to Windows, after entering your password, you will see a display that shows you the last successful logon and any unsuccessful logon attempts. You’ll have to click OK to finish signing into Windows.

现在，您可以关闭注册表编辑器。 下次登录Windows时，输入密码后，您将看到一个显示屏，该显示屏显示上一次成功登录和所有失败登录尝试。 您必须单击“确定”以完成登录Windows。

If you want to reverse these changes, all you have to do is return to the Registry Editor and change the DisplayLastLogonInfo value from 1 back to 0.

如果要撤消这些更改，则只需返回注册表编辑器并将DisplayLastLogonInfo值从1更改回0。

下载我们的一键式注册表黑客 (Download Our One-Click Registry Hack)

If you don’t feel like diving into the Registry yourself, we’ve created two downloadable registry hacks you can use. One hack shows the previous logon info on the sign in screen and the other removes that info, restoring the default setting. Both are included in the following ZIP file. Double-click the one you want to use, click through the prompts, and then restart your computer.

如果您不想自己进入注册表，我们创建了两个可供下载的注册表黑客。 一种黑客行为会在登录屏幕上显示先前的登录信息，而另一种黑客会删除该信息，以恢复默认设置。 两者都包含在以下ZIP文件中。 双击要使用的计算机，单击提示，然后重新启动计算机。

Display Last Logon Info Hacks

显示上次登录信息的黑客

These hacks are really just the System key, stripped down to the two values we described above, and then exported to a .REG file. Running the “Show Last Logon Info at Sign In” hack changes the DisplayLastLogonInfo  value to 1. Running the “Remove Last Logon Info at Sign In Personal Info at Logon” hack sets the value back to 0.  And if you enjoy fiddling with the Registry, it’s worth taking the time to learn how to make your own Registry hacks.

这些hack实际上只是System密钥，被简化为我们上面描述的两个值，然后导出到.REG文件。 运行“在登录时显示上次登录信息” hack会将DisplayLastLogonInfo值更改为1。运行“在登录时删除上次登录信息时的个人信息” hack将值重置为0。如果您喜欢摆弄注册表，值得花时间学习如何进行自己的Registry hacks 。

专业版和企业版用户：使用本地组策略编辑器显示以前的登录信息 (Pro and Enterprise Users: Show Previous Logon Information with the Local Group Policy Editor)

If you’re using Windows 10 Pro or Enterprise, the easiest way to show previous logon information at sign in is by using the Local Group Policy Editor. It’s a pretty powerful tool, so if you’ve never used it before, it’s worth taking some time to learn what it can do. Also, if you’re on a company network, do everyone a favor and check with your admin first. If your work computer is part of a domain, it’s also likely that it’s part of a domain group policy that will supersede the local group policy, anyway.

如果您使用的是Windows 10 Pro或Enterprise，则在登录时显示以前的登录信息的最简单方法是使用“本地组策略编辑器”。 这是一个非常强大的工具，因此，如果您以前从未使用过它，那么值得花一些时间来学习它可以做什么 。 另外，如果您在公司网络中，请给所有人一个帮助，并首先与您的管理员联系。 如果您的工作计算机是域的一部分，则它也很可能是域组策略的一部分，无论如何，该组策略将取代本地组策略。

In Windows 10 Pro or Enterprise, hit Start, type gpedit.msc, and press Enter.

在Windows 10 Pro或Enterprise中，单击“开始”，键入gpedit.msc，然后按Enter。

In the Local Group Policy Editor, in the left-hand pane, drill down to Computer Configuration > Administrative Templates > Windows Components > Windows Logon Options. On the right, find the “Display information about previous logons during user logon” item and double-click it.

在“本地组策略编辑器”的左侧窗格中，向下钻取到“计算机配置”>“管理模板”>“ Windows组件”>“ Windows登录选项”。 在右侧，找到“在用户登录期间显示有关先前登录的信息”项，然后双击它。

In the properties window that opens, select the Enabled option and then click OK.

在打开的属性窗口中，选择“启用”选项，然后单击“确定”。

Exit the Local Group Policy Editor and restart your computer (or sign out and back in) to test the changes. If at any time you want to remove the logon information from the sign in screen again, just follow the same procedure and set that option back to disabled.

退出本地组策略编辑器，然后重新启动计算机(或注销并重新登录)以测试更改。 如果您想在任何时候再次从登录屏幕上删除登录信息，只需按照相同的步骤并将该选项重新设置为“禁用”即可。

And that’s it. If you’re using any version of Windows from Vista through 10 (remember, local accounts only in Windows 8 and 10), you can have Windows display previous logon information whenever a user signs in. At the very least, knowing whether or not other people have tried logging onto your user account is good information to have. And putting that information right on the sign in screen makes it hard to miss.

就是这样。 如果您使用的是从Vista到10的任何版本的Windows(请记住，本地帐户仅在Windows 8和10中使用)，则只要用户登录，就可以让Windows显示以前的登录信息。至少，要知道是否其他人们曾尝试登录到您的用户帐户，这是很好的信息。 而且，将这些信息正确地放在登录屏幕上很难错过。

翻译自: https://www.howtogeek.com/259722/how-to-see-previous-logon-information-on-the-windows-sign-in-screen/

查看windows登陆日志