Event ID 4801 corresponds to The workstation was unlocked. You can turn on logging for this event as I explain in my answer here.
Now you can use schtasks as follows to create the task triggered by this event:
schtasks /Create /RU "Username" /SC ONEVENT /MO "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4801]]" /EC Security /TN "Taskname" /TR "Drive:\path to\program.exe" /F
Here I've used the /EC parameter to define the Event Channel (in this case the Security log). The MO or Modifier parameter is used to specify the XPath filter required to match events we are interested in.
However, you might state that you can use an On workstation unlock trigger without needing to turn on logging for the event, and you would be correct of course. The available triggers for a task are as follows:
The ones I've marked in green can be specified using schtasks' /SC parameter:
/SC schedule Specifies the schedule frequency.
Valid schedule types: MINUTE, HOURLY, DAILY, WEEKLY,
MONTHLY, ONCE, ONLOGON, ONSTART, ONIDLE, ONEVENT.
The ones I've marked in red don't seem to have corresponding schtasks options. There may be an obscure way to create tasks using such triggers, but till date I haven't found it and am inclined to think that it's just not possible (the lack of easily understandable yet detailed documentation about schtasks' parameters doesn't help either).
There is a workaround of course, which leads us to (drum-roll please)...
Simply create the task with the required triggers (more than one if you want) using the Task Scheduler UI and export it as an XML. Now of course you can import the XML on demand and recreate the task perfectly:
schtasks /Create /TN "Taskname" /XML "ExportedTask.xml"