0

I came in to work and found that my desktop has moved around and applications have been closed down. Is there a way to determine when my computer was unlocked?

Improve this question
6
  • The Event Viewer (eventvwr.msc) should provide further details.
    – and31415
    Sep 3, 2014 at 13:51
  • I was looking at that, but I couldn't find what I was looking for. :( That's why I was asking here. What should I be looking for?
    – Adrian
    Sep 3, 2014 at 14:09
  • Did you check the Security category? It should list all logon/logoff and lock/unlock events.
    – and31415
    Sep 3, 2014 at 14:14
  • You'll find related events only if you configured it before. Otherwise, there isn't much you can do.
    – EliadTech
    Sep 3, 2014 at 14:21
  • How do you configure them?
    – Adrian
    Sep 3, 2014 at 15:07

2 Answers 2

Reset to default
1

As mentioned above, you can use Event Viewer to see who logged in. You will probably want to check which event ID to filter on, e.g. 4624 (http://support.microsoft.com/kb/947226) and then find the last entries that don't correspond to your username.

Right-click on Security and select "Filter Current Log"

Instead of enter the Event ID number you want, e.g. 4624

Click OK

Improve this answer
1
  • Is there a way to get older dates then today?
    – Adrian
    Sep 5, 2014 at 18:46
1

You can run gwmi win32_userprofile -ComputerName computer_name_here command in powershell which will generate a list of user profiles, paths, SIDs, login time etc. What you should look at are: LastUseTime and LocalPath variables. Both of those will give you clues as to who logged in and when.

Improve this answer
1
  • Is there a way to get the last 10 login times?
    – Adrian
    Sep 5, 2014 at 18:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .