Looking at the answers and comments to this question, it seems that user log-ins can be monitored by checking for Event ID 4624 in the event logs.
Is there a way (through event logs, group policy, or other mechanism) to get Windows to display an alert (e.g. a popup or message in the notification area) when someone logs into the local machine?
Note: there is this other question (but it is about connecting to a shared folder remotely) and this question (which does not specifically ask for any alert mechanism).
Best Answer
With Windows 7 (not sure about subsequent versions) you can create a scheduled task that is triggered by a specific event and that displays a message.
I have not tested this however so I am not sure how well it works and/or if it works for every type of login.
But you could do as follows, using that Event ID 4624 as an example:
Navigate to Task Scheduler (e.g. by right-clicking on "Computer" in Start Menu and selecting Manage...) and click on Create Basic Task...:
Give the Task at least a name:
Click Next and select "When a specific event is logged":
Click Next and select these values:
Click Next and select "Display a message":
Click Next and enter the message parameters:
Click Next and Finish: