Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to get a list of the following times:

  • whenever windows is locked (using windows+l combo)
  • whenever windows is unlocked

    in the past week?

I've tried poking in the event log, to no avail.

Many thanks!

share|improve this question
up vote 14 down vote accepted

Event ID 4800 should correspond to The workstation was locked, and similarly Event ID 4801 should correspond to The workstation was unlocked.

If you don't see them in the Event Viewer, for recording future events try opening the Local Group Policy Editor (Start / Run / gpedit.msc), navigating to:

Computer Configuration / Windows Settings / Security Settings / Advanced Audit Policy Configuration / System Audit Policies - Local Group Policy Object / Logon/Logoff / Audit Other Logon/Logoff Events

and enabling the checkboxes for Success and Failure:


share|improve this answer
+1 for – nixda Jan 6 '13 at 22:59

I found events corresponding to locking and unlocking in my Windows 7 Security Event log

4634 Logoff with (WinKey +L)
4624 and 4672 unlocking.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.