See Who Connected to Your Mac and When

Yes—macOS can show some evidence of who connected to your Mac, but there is no single screen that lists every person who has ever connected. You can check recent login records and, depending on the connection method, inspect File Sharing, Screen Sharing, SSH, and other service logs; what you can see depends on the macOS version, account permissions, and how long records have been retained.

What macOS records

A Mac may accept connections through several different features. Someone signing in at the keyboard, logging in over Screen Sharing, accessing a shared folder, or connecting through Remote Login may leave different records. A successful login is also different from an unsuccessful attempt: failed attempts may appear in system logs, but they do not necessarily show up in the same place as completed sessions.

For a quick overview of recent account logins, open Terminal and use the built-in last command. It reads system login records and commonly shows account names, login times, and session details. These records are not a complete, permanent audit trail: they can be rotated, may omit some kinds of access, and can be difficult to interpret without knowing which service generated an entry.

To see whether remote access is enabled, open System Settings and review General > Sharing. Available sharing options and their labels can vary by macOS release. A listed service being switched on means it may accept connections under its configured permissions; it does not prove that anybody used it.

Check recent login sessions in Terminal

Start with the simplest check. Open Terminal from Applications > Utilities, type last, and press Return. The output may include local logins, remote sessions, and system entries. Look for account names and times that you do not recognize, but do not assume that every unfamiliar line represents a person accessing the Mac.

You can limit the output to a particular account by adding its short account name after the command, for example last alex. Replace alex with the account’s actual short name. Use who to see users with sessions currently recorded as active; it is a snapshot, not a history of everyone who connected.

• last is useful for reviewing recorded login history.
• who helps check for sessions that appear active now.
• Neither command provides a guaranteed, complete list of all file shares, network probes, or attempted connections.

Entries can include system accounts or service-related activity, and time-zone or sleep behavior can make timestamps confusing. If you find a suspicious entry, note its account and time, then compare it with your own use of the Mac and the relevant service settings before drawing conclusions.

Review sharing and remote-access settings

Go to System Settings > General > Sharing and inspect each service that is enabled. Common options include File Sharing, Screen Sharing, and Remote Login. Selecting a service usually reveals its access controls, such as which accounts are permitted. The exact controls depend on the service and macOS release.

• File Sharing: Check which folders are shared and which users or groups have access. A connection to a shared folder may not correspond to a normal desktop login.
• Screen Sharing: Review who is allowed to control or view the Mac remotely. Screen sharing may be available through built-in Apple features or other installed software.
• Remote Login: This enables SSH access for permitted users. If you do not use it, turning it off reduces the number of services available to connect to.

Turning off a service prevents future connections through that service, but it does not explain whether it was used previously. If you need to investigate a particular event, preserve the approximate time and check the logs for the relevant service while they are still available.

Use Console and logs for more detail

The Console app can help search system log messages. Open Console from Applications > Utilities, select the Mac in the sidebar if needed, and search around the time of interest for terms related to the service, such as “ssh” or “screensharing.” You can also use Terminal’s log show command to search a time range, but its output can be technical and noisy.

For example, a time-bounded log query can be built with log show --last 1h to inspect messages from roughly the past hour. To narrow results, add a predicate or search term appropriate to the event. Logging details change over time, and privacy controls can restrict what is displayed. A matching message may indicate a service event, not necessarily a confirmed human login; correlate it with account names, timestamps, and the service’s own records.

Logs are generally more useful for a focused question—such as whether SSH activity occurred during a particular hour—than for producing a reliable lifetime list. Some records are short-lived, and routine system messages can be mistaken for connections. If the Mac is managed by an organization, its administrators may also collect records outside the local Console app.

What a connection record can and cannot tell you

A record may identify an account, a time, or a network address, but those details do not always identify a person. Multiple people can use one account; a device can use a changing network address; and an address may belong to a router, VPN, or shared network. Conversely, the absence of a visible record does not prove that no connection occurred: logs may have expired, a third-party app may keep separate logs, or the access method may not create a record you can readily find.

Do not confuse nearby devices, AirDrop visibility, or a Mac appearing on a local network with a successful login. Discovery means a device could be visible or reachable; it does not by itself mean someone opened files or controlled the computer. Likewise, a failed password attempt is not evidence that access succeeded.

If you find an unfamiliar connection

First, avoid deleting logs or making broad changes until you have noted the relevant times and account names. Then take practical steps to limit access:

1. Turn off sharing services you do not need in System Settings > General > Sharing.
2. Review user accounts in System Settings > Users & Groups, and remove or disable accounts you recognize as unnecessary.
3. Change the password for any account that may have been exposed, using a unique password. Secure the Apple Account separately if you suspect that account is involved.
4. Check for remote-access apps you installed and review their permissions and settings. Remove software only if you know it is unwanted and can do so safely.
5. Install available macOS updates and, if this is a work or school Mac, contact the administrator before changing managed settings.

If there are signs of ongoing access or sensitive data exposure, disconnecting the Mac from the network can limit further remote activity while you seek trusted technical help. A log entry alone is not enough to establish that data was viewed or copied.

Frequently Asked Questions

Can I see everyone who has ever connected to my Mac?
No. macOS does not provide one complete, permanent history covering every local login, shared-folder visit, remote session, and connection attempt. Available records depend on the service and log retention.

How do I see who is logged in right now?
Open Terminal and run who. It reports sessions currently recorded as active, but does not necessarily show every network connection or background service using the Mac.

Does “last” show failed login attempts?
last primarily displays recorded login sessions. Failed attempts may instead be present in system logs, depending on the macOS version and logging details.

Can I identify a person from an IP address?
Usually not with confidence. An address may identify a network or intermediary rather than a specific person, and it can change or be shared by several devices.

Will turning off File Sharing erase its history?
Turning the service off prevents future access through that feature, but it does not necessarily erase existing system logs. Those logs may be retained only temporarily.

Related

• Best Skype Alternatives: Top Picks for Calls and Chat
• ARK With Friends: Dedicated Server vs Co-op
• Can’t Claim or Access a Grok Email Address? What to Do