Can My Employer See When I Log Into My Computer?

Yes. On a work computer, your employer can see when you log in, and usually when you lock, unlock and log out. Windows writes each sign-in to its Security log (event 4624) and each lock and unlock to events 4800 and 4801 when that auditing is on. A company account also leaves a sign-in record on the domain controller or in Microsoft Entra ID, and security software such as Microsoft Defender for Endpoint forwards device logons to an IT console. Whether anyone looks is a different question: most IT teams read these logs for security, not attendance, unless the company also runs time-tracking or monitoring software.

The time you appear online in Slack is a separate record. Slack shows you active while Slack is open and you use the computer, and away after 10 minutes with no keyboard or mouse input.

What records your login time

The Windows log sits on the computer itself. It becomes visible to your employer when something ships it off the machine: a security agent, a log collector (a SIEM), or an admin who opens Event Viewer remotely. On a company-managed laptop, assume at least one of those is running.

How a login reaches your employer

A sign-in to Windows with a company account does two things. The laptop logs the event locally, and it asks the company's directory (Active Directory or Entra ID) to check your password, which the directory also logs. So even a laptop with no monitoring software leaves a record of when your company account signed in. Unlocking with Windows Hello counts as a sign-in too.

A Mac managed with Jamf, Kandji or Intune reports device data to the company. Sign-in, sleep and wake times are in macOS logs and can be collected (our output is below), but most Mac management tools do not report them by default. Monitoring software is different: tools such as ActivTrak, Teramind and Hubstaff are sold to report when each person started and stopped working. How they work, and how to spot one, is in how to tell if you are being monitored at work and what is bossware.

Can my boss see when I log in?

Your manager usually cannot open these logs. IT and security teams can. A manager sees login times when:

• • the company uses time-tracking or monitoring software that puts first and last activity in a dashboard,
• • HR asks IT for a report, which happens in investigations and disputes,
• • your own apps show it, such as Slack or Teams presence turning green at 9:40 instead of 9:00.

The last one is the one people notice. Teams sets you Available when you use your computer and Away after about 5 minutes without input; Slack goes away after 10 minutes without input on the computer. Both are covered in does Teams track activity and can Slack be used to monitor employees.

See your own login history

On Windows, the System log keeps user logon and logoff notices you can read without admin rights. In PowerShell:

# last 20 logons and logoffs on this PC (no admin needed)
Get-WinEvent -FilterHashtable @{ LogName = 'System'; ProviderName = 'Microsoft-Windows-Winlogon'; Id = 7001, 7002 } -MaxEvents 20 |
    Select-Object TimeCreated, @{ n = 'Event'; e = { if ($_.Id -eq 7001) { 'Logon' } else { 'Logoff' } } }

The Security log with events 4624, 4634, 4800 and 4801 needs an admin account: open Event Viewer > Windows Logs > Security and use Filter Current Log with those IDs. If 4800 and 4801 never appear, the lock and unlock audit policy is off on your PC.

On a Mac, two built-in commands show when the Mac was used:

# console logins since the last log rotation
last console | head

# recent sleep and wake times
pmset -g log | grep -E ' (Sleep|Wake)  ' | tail -20

We ran both on our own MacBook Pro (macOS 26.5.2) on 4 October 2026. last console:

sieunpark  console   Tue Sep 29 16:25   still logged in
sieunpark  console   Mon Sep 28 15:44 - 16:24 (1+00:40)
sieunpark  console   Tue Sep  8 04:39 - 15:42 (20+11:03)
sieunpark  console   Mon Aug 31 03:18 - 04:38 (8+01:19)
sieunpark  console   Sat Aug 22 09:32 - crash (4+18:54)

And the end of pmset -g log, trimmed to the timestamp and reason:

2026-10-01 19:03:58 +0900 Sleep  Entering Sleep state due to 'Clamshell Sleep'
2026-10-01 19:09:50 +0900 Sleep  Entering Sleep state due to 'Maintenance Sleep'
2026-10-01 19:26:19 +0900 Sleep  Entering Sleep state due to 'Sleep Service Back to Sleep'
2026-10-01 19:41:37 +0900 Wake   DarkWake to FullWake from Deep Idle : due to Notification

What this shows about a Mac:

• A Mac "login" is rare. Our current console session started on 29 September and was still open five days later; sessions before it lasted from 1 to 20 days. Unlocking the screen or opening the lid does not start a new one. So a Mac's login record says when you restarted or signed out, not when you started work each day.

• Sleep and wake are the daily trace. pmset -g log records each sleep and wake to the second, with the reason: closing the lid shows as Clamshell Sleep. Monitoring software or a log collector that reads this can see roughly when the laptop was opened and closed.

• Both are local. Nothing in either log leaves the Mac by itself; it reaches your employer only through a management or security agent that collects it.

Is it legal for my employer to track login times?

In the US, an employer can generally record sign-ins on computers and accounts it owns. New York, Connecticut and Delaware require employers to give written notice of electronic monitoring. In the EU and UK, the tracking must be proportionate and you must be told. Details by place are in is it legal for my employer to monitor me. On a personal computer with no company software, sign-in times stay on your machine, though your sign-ins to company email or Slack are still logged by those services; see can my employer monitor my personal computer.

FAQ

Can my employer see when I lock and unlock my computer? Yes, if lock and unlock auditing is on. Windows records them as events 4800 and 4801.

Does logging into Outlook or Teams record the time? Yes. Microsoft Entra ID keeps a sign-in log with time, IP address and device for each app sign-in.

Can my employer see when I log into my personal computer? No, not the computer itself. Your sign-ins to company apps from it are still logged.

Does a Mac log when I open the lid? Yes, as a wake in pmset -g log, with the time to the second. Closing the lid shows as Clamshell Sleep.