Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to determine the time since a Windows 7 machine was last unlocked. By unlocked I mean the user locks the machine by clicking Start->ShutDown->Lock or by pressing the Windows key + L, and then at a later time unlocks the machine by clicking on the user icon (and depending on settings typing in password)?

share|improve this question
I know you can set auditing for logon/logoff, but I can't seem to find any policy to log when you unlock the machine. Hmm...maybe somebody will know how to find such a thing, but I'd expect to find it in Group Policy Editor and it's just Not Here™. Out of curiosity (and possibly finding a different solution that meets your goals), what's the goal here? – Shinrai Aug 23 '11 at 14:22
The rather innocuous task of determining when I started work. I rarely log off, but always lock in the evening and then unlock in the morning. – DAC Aug 23 '11 at 14:25
Hmm...there's probably software that will do something similar (not necessarily logging the unlock event, but just mouse/keyboard activity or something), but I don't know of any. – Shinrai Aug 23 '11 at 14:45
up vote 22 down vote accepted

Open Event Viewer, browse to Windows Logs > Security and look for an event with ID 4624:

Details for event 4624

Logon Type: 7 indicates a workstation unlock.

share|improve this answer

I don't know of any pre-made solutions for this. You would probably have to set up a set of scripts to detect the workstation lock and unlock events, and then mark the time at which the event happened (and calculate the difference or alike).

You can pull this off in PowerShell; and there's an answer on StackOverflow which explains this and provides and example usage/scripting to get you started.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .