Windows – Time since Windows 7 was last unlocked

windows 7

Is it possible to determine the time since a Windows 7 machine was last unlocked. By unlocked I mean the user locks the machine by clicking Start->ShutDown->Lock or by pressing the Windows key + L, and then at a later time unlocks the machine by clicking on the user icon (and depending on settings typing in password)?

Best Answer

Open Event Viewer, browse to Windows Logs > Security and look for an event with ID 4624:

Details for event 4624

Logon Type: 7 indicates a workstation unlock.