Should be pretty easy. You just have to find the right Event ID from Windows.
It’s in the Security Log and the Event ID is 4720.
Give it a try and tell me if it worked. 
Should be pretty easy. You just have to find the right Event ID from Windows.
It’s in the Security Log and the Event ID is 4720.
Give it a try and tell me if it worked.