How to know when I last logged in from lock mode?

Question

I usually lock my PC with password while going out, but still there is chance one can still access my information by logging in.

So, how do I find out at what time I last logged in?

Answer 1

How do I find if Windows has been logged in from the lock screen?

Logging in via the lock screen generates a security log trail by default. To find this:

• run Event Viewer (Win+r-> eventvwr.msc, or Win+x->v, or from the Control Panel etc)

• Expand Windows Logs in the left-hand pane

• Select the Security log type

• Look for Logon events, with type 7 (Logon Type 7 = Unlock Workstation¹), for logins from the lock screen

See illustration:

---

^{1 per this source for Windows logon event types}

Answer 2

If you (or your domain administrator) have enabled account auditing, then you can find that information in your Security Event Log.

1. Click Start
2. Type Event Viewer and press Enter
3. Select Windows Logs > Security from the Event Viewer tree.
4. Look for Audit Success or failure messages marked Logon.

Several entries will often appear for any given logon. You can match logon and logoff entries based on the Logon ID value within each event detail.

To enable Account Auditing Settings:

1. Click Start
2. Type secpol.msc and press Enter
3. Navigate to Local Policy > Audit Policy
4. Right click the Audit account logon events policy option
5. Select Properties.
6. Check both the Success and Failure check boxes.