{"id":71,"date":"2015-02-13T12:15:18","date_gmt":"2015-02-13T10:15:18","guid":{"rendered":"http:\/\/www.kopf.com.br\/kaplof\/?p=71"},"modified":"2015-02-13T12:16:23","modified_gmt":"2015-02-13T10:16:23","slug":"find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log","status":"publish","type":"post","link":"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/","title":{"rendered":"Find out when Windows was locked and unlocked using the System Event Log"},"content":{"rendered":"

Sometimes you may need to to find out when the machine was locked and unlocked (for time booking for instance). Unfortunately, there is no such a thing as lock\/unlock Windows events. When the user locks or unlocks the workstation a special Logon or Logoff event is created in the Windows Events Log with Logon Type = 7.<\/p>\n

To filter all such events, you have to:<\/p>\n

    \n
  1. Open the Windows Event Viewer<\/li>\n
  2. On the left tree bar select Windows Logs > Security<\/li>\n
  3. On the right bar click on “Filter Current Log…”<\/li>\n
  4. Select the XML tab and click on “Edit query manually”<\/li>\n
  5. Enter the below query:<\/li>\n<\/ol>\n
    <QueryList>\r\n  <Query Id=\"0\" Path=\"Security\">\r\n    <Select Path=\"Security\">\r\n    *[EventData[Data[@Name='LogonType']='7']\r\n     and\r\n     (System[(EventID='4634')] or System[(EventID='4624')])\r\n     ]<\/Select>\r\n  <\/Query>\r\n<\/QueryList>\r\n<\/pre>\n
     <\/p>\n
    For a full list of all available logon types, please refer to the table below:<\/p>\n
     <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
    Logon type<\/th>\nLogon title<\/th>\nDescription<\/th>\n<\/tr>\n
    2<\/td>\nInteractive<\/td>\nA user logged on to this computer.<\/td>\n<\/tr>\n
    3<\/td>\nNetwork<\/td>\nA user or computer logged on to this computer from the network.<\/td>\n<\/tr>\n
    4<\/td>\nBatch<\/td>\nBatch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention.<\/td>\n<\/tr>\n
    5<\/td>\nService<\/td>\nA service was started by the Service Control Manager.<\/td>\n<\/tr>\n
    7<\/td>\nUnlock<\/td>\nThis workstation was unlocked.<\/td>\n<\/tr>\n
    8<\/td>\nNetworkCleartext<\/td>\nA user logged on to this computer from the network. The user’s password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext).<\/td>\n<\/tr>\n
    9<\/td>\nNewCredentials<\/td>\nA caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections.<\/td>\n<\/tr>\n
    10<\/td>\nRemoteInteractive<\/td>\nA user logged on to this computer remotely using Terminal Services or Remote Desktop.<\/td>\n<\/tr>\n
    11<\/td>\nCachedInteractive<\/td>\nA user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"
    Sometimes you may need to to find out when the machine was locked and unlocked (for time booking for instance). Unfortunately, there is no such a thing as lock\/unlock Windows events. When the user locks or unlocks the workstation a special Logon or Logoff event is created in the Windows Events Log with Logon Type […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,14],"tags":[],"yoast_head":"\nFind out when Windows was locked and unlocked using the System Event Log - Kaplof<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Find out when Windows was locked and unlocked using the System Event Log - Kaplof\" \/>\n<meta property=\"og:description\" content=\"Sometimes you may need to to find out when the machine was locked and unlocked (for time booking for instance). Unfortunately, there is no such a thing as lock\/unlock Windows events. When the user locks or unlocks the workstation a special Logon or Logoff event is created in the Windows Events Log with Logon Type […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/\" \/>\n<meta property=\"og:site_name\" content=\"Kaplof\" \/>\n<meta property=\"article:published_time\" content=\"2015-02-13T10:15:18+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2015-02-13T10:16:23+00:00\" \/>\n<meta name=\"author\" content=\"Bruno Marotta\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Bruno Marotta\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/\"},\"author\":{\"name\":\"Bruno Marotta\",\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/#\/schema\/person\/a096a6de30951e12938c6a800eeaa891\"},\"headline\":\"Find out when Windows was locked and unlocked using the System Event Log\",\"datePublished\":\"2015-02-13T10:15:18+00:00\",\"dateModified\":\"2015-02-13T10:16:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/\"},\"wordCount\":320,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/#organization\"},\"articleSection\":[\"Tips\",\"Windows\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/\",\"url\":\"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/\",\"name\":\"Find out when Windows was locked and unlocked using the System Event Log - Kaplof\",\"isPartOf\":{\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/#website\"},\"datePublished\":\"2015-02-13T10:15:18+00:00\",\"dateModified\":\"2015-02-13T10:16:23+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.kopf.com.br\/kaplof\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Find out when Windows was locked and unlocked using the System Event Log\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/#website\",\"url\":\"https:\/\/www.kopf.com.br\/kaplof\/\",\"name\":\"Kaplof\",\"description\":\"Sharing problems and solutions for software development\",\"publisher\":{\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.kopf.com.br\/kaplof\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/#organization\",\"name\":\"Kopf\",\"url\":\"https:\/\/www.kopf.com.br\/kaplof\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/i0.wp.com\/www.kopf.com.br\/kaplof\/wp-content\/uploads\/2015\/04\/Logo-grande.png?fit=78%2C76&ssl=1\",\"contentUrl\":\"https:\/\/i0.wp.com\/www.kopf.com.br\/kaplof\/wp-content\/uploads\/2015\/04\/Logo-grande.png?fit=78%2C76&ssl=1\",\"width\":78,\"height\":76,\"caption\":\"Kopf\"},\"image\":{\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/#\/schema\/person\/a096a6de30951e12938c6a800eeaa891\",\"name\":\"Bruno Marotta\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.kopf.com.br\/kaplof\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/8e15f82b4b9672c32c601286a40eb46f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/8e15f82b4b9672c32c601286a40eb46f?s=96&d=mm&r=g\",\"caption\":\"Bruno Marotta\"},\"url\":\"https:\/\/www.kopf.com.br\/kaplof\/author\/bmarotta\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Find out when Windows was locked and unlocked using the System Event Log - Kaplof","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/","og_locale":"en_US","og_type":"article","og_title":"Find out when Windows was locked and unlocked using the System Event Log - Kaplof","og_description":"Sometimes you may need to to find out when the machine was locked and unlocked (for time booking for instance). Unfortunately, there is no such a thing as lock\/unlock Windows events. When the user locks or unlocks the workstation a special Logon or Logoff event is created in the Windows Events Log with Logon Type […]","og_url":"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/","og_site_name":"Kaplof","article_published_time":"2015-02-13T10:15:18+00:00","article_modified_time":"2015-02-13T10:16:23+00:00","author":"Bruno Marotta","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Bruno Marotta","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/#article","isPartOf":{"@id":"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/"},"author":{"name":"Bruno Marotta","@id":"https:\/\/www.kopf.com.br\/kaplof\/#\/schema\/person\/a096a6de30951e12938c6a800eeaa891"},"headline":"Find out when Windows was locked and unlocked using the System Event Log","datePublished":"2015-02-13T10:15:18+00:00","dateModified":"2015-02-13T10:16:23+00:00","mainEntityOfPage":{"@id":"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/"},"wordCount":320,"commentCount":0,"publisher":{"@id":"https:\/\/www.kopf.com.br\/kaplof\/#organization"},"articleSection":["Tips","Windows"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/","url":"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/","name":"Find out when Windows was locked and unlocked using the System Event Log - Kaplof","isPartOf":{"@id":"https:\/\/www.kopf.com.br\/kaplof\/#website"},"datePublished":"2015-02-13T10:15:18+00:00","dateModified":"2015-02-13T10:16:23+00:00","breadcrumb":{"@id":"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.kopf.com.br\/kaplof\/find-out-when-windows-was-locked-and-unlocked-using-the-system-event-log\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.kopf.com.br\/kaplof\/"},{"@type":"ListItem","position":2,"name":"Find out when Windows was locked and unlocked using the System Event Log"}]},{"@type":"WebSite","@id":"https:\/\/www.kopf.com.br\/kaplof\/#website","url":"https:\/\/www.kopf.com.br\/kaplof\/","name":"Kaplof","description":"Sharing problems and solutions for software development","publisher":{"@id":"https:\/\/www.kopf.com.br\/kaplof\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.kopf.com.br\/kaplof\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.kopf.com.br\/kaplof\/#organization","name":"Kopf","url":"https:\/\/www.kopf.com.br\/kaplof\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.kopf.com.br\/kaplof\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/www.kopf.com.br\/kaplof\/wp-content\/uploads\/2015\/04\/Logo-grande.png?fit=78%2C76&ssl=1","contentUrl":"https:\/\/i0.wp.com\/www.kopf.com.br\/kaplof\/wp-content\/uploads\/2015\/04\/Logo-grande.png?fit=78%2C76&ssl=1","width":78,"height":76,"caption":"Kopf"},"image":{"@id":"https:\/\/www.kopf.com.br\/kaplof\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.kopf.com.br\/kaplof\/#\/schema\/person\/a096a6de30951e12938c6a800eeaa891","name":"Bruno Marotta","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.kopf.com.br\/kaplof\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/8e15f82b4b9672c32c601286a40eb46f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8e15f82b4b9672c32c601286a40eb46f?s=96&d=mm&r=g","caption":"Bruno Marotta"},"url":"https:\/\/www.kopf.com.br\/kaplof\/author\/bmarotta\/"}]}},"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.kopf.com.br\/kaplof\/wp-json\/wp\/v2\/posts\/71"}],"collection":[{"href":"https:\/\/www.kopf.com.br\/kaplof\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kopf.com.br\/kaplof\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kopf.com.br\/kaplof\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kopf.com.br\/kaplof\/wp-json\/wp\/v2\/comments?post=71"}],"version-history":[{"count":3,"href":"https:\/\/www.kopf.com.br\/kaplof\/wp-json\/wp\/v2\/posts\/71\/revisions"}],"predecessor-version":[{"id":74,"href":"https:\/\/www.kopf.com.br\/kaplof\/wp-json\/wp\/v2\/posts\/71\/revisions\/74"}],"wp:attachment":[{"href":"https:\/\/www.kopf.com.br\/kaplof\/wp-json\/wp\/v2\/media?parent=71"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kopf.com.br\/kaplof\/wp-json\/wp\/v2\/categories?post=71"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kopf.com.br\/kaplof\/wp-json\/wp\/v2\/tags?post=71"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}