up vote 5 down vote favorite
share [g+] share [fb]

Is it possible to determine the time since a Windows 7 machine was last unlocked. By unlocked I mean the user locks the machine by clicking Start->ShutDown->Lock or by pressing the Windows key + L, and then at a later time unlocks the machine by clicking on the user icon (and depending on settings typing in password)?

link|improve this question
I know you can set auditing for logon/logoff, but I can't seem to find any policy to log when you unlock the machine. Hmm...maybe somebody will know how to find such a thing, but I'd expect to find it in Group Policy Editor and it's just Not Here™. Out of curiosity (and possibly finding a different solution that meets your goals), what's the goal here? – Shinrai Aug 23 '11 at 14:22
The rather innocuous task of determining when I started work. I rarely log off, but always lock in the evening and then unlock in the morning. – DAC Aug 23 '11 at 14:25
Hmm...there's probably software that will do something similar (not necessarily logging the unlock event, but just mouse/keyboard activity or something), but I don't know of any. – Shinrai Aug 23 '11 at 14:45
feedback

2 Answers

up vote 8 down vote accepted

Open Event Viewer, browse to Windows Logs > Security and look for an event with ID 4624:

Details for event 4624

Logon Type: 7 indicates a workstation unlock.

link|improve this answer
feedback
up vote 0 down vote

I don't know of any pre-made solutions for this. You would probably have to set up a set of scripts to detect the workstation lock and unlock events, and then mark the time at which the event happened (and calculate the difference or alike).

You can pull this off in PowerShell; and there's an answer on StackOverflow which explains this and provides and example usage/scripting to get you started.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.