Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let me preface by saying I am extremely forgetful.

I would like to have a log when I login, logout, lock and unlock my workstation.

(in my case so i can track the nunmber of hours i spend at the PC)

the EventViewer is alomst good enought. The Security view show Logon/Logoff events. I just need to know the Lock/Unlock events also.

or a method to call a script on those events so i can do the logging myself.

share|improve this question

You know, there's a cheap little bluetooth device out there that might help you.

You plug it in to your USB port and keep the "dongle" in your pocket.

When you walk away from your PC (say 6 feet or so) the computer automatically locks. When you come back within range it automatically unlocks.


I finally found the one I have. Its a PC Defender Wireless Screen Lock. Not sure if they sell them anymore but I've seen plenty of them out there at places like Fry's Electronics, etc. Here's a link to show you what one looks like:

On that note... there are also programs out there such as Blue Lock 1.92 and others which can tie in to the Bluetooth on your phone and perform certain actions (usually lock the screen) when you walk away from your PC (taking your phone with you).

Another solution would be to use your webcam to take periodic screenshots, say every 5min. Then just count the shots that have your face in them. Microsoft has a Power Toy that does this. Also doubles as a security camera. ;-)

share|improve this answer
LOL... how hard did you look my friend? A google of "Wireless PC Lock" still turns up LOTS of results. Try here: – KPWINC Feb 18 '10 at 22:56

Unfortunately there is no "lock" workstation event -- unlocking (with the correct audit settings turned on can trigger a pair of 528/538 events with a type of '7'.

A better idea might be to look at the various tools out there that can traack machine usage for billing purposes. They can usually give you a list of what application had focus during what time frame.

We use Spector 360 to do this on a network wide scale.

share|improve this answer

For anyone who likes to know how to do this in Windows 7 (like me): Open Local Security Policy (can be found by pressing the Windows key once and typing "Local Security Policy") => Advanced Audit Policy Configuration => ... => Logon/Logoff => Audit Other Logon/Logoff Events => double click and mark all the check boxes => save

Screenshot: Audit Other Logon/Logoff Events

Now you get the events in the Event Viewer under Windows Logs => Security (Event IDs 4800 and 4801)

share|improve this answer

There is a "logon type" for "Unlock Workstation" (type 7) that will get logged into the event log. I'm not sure this going to give you want you want, though.

The easiest way to do what you want would be to run a user-land program that you interacted with to keep time records.

You could develop a GINA library that log your own events when a lock workstation or unlock workstation occured, since both of those events have callbacks into the GINA. (In Vista, GINA was replaced with Credential Providers and it's not immediately clear to me if they get a callback when a lock workstation occurs or not.)

share|improve this answer

We have a login and logoff script that runs via group policy that logs to a file each time someone logs in or off - that might help? Login file contains the following (set up the \server01\audit$ share first!)

@echo %username%,%date%,%time%,%computername%,%clientname% >>\\server01\audit$\%username%login.txt
share|improve this answer

i've found a partial answer..

the local secturity settings Auditpolicy..

i have turned on "Audit account logon events"

i know get logon/logoff events when i lock the PC.

however teh logoff (ie lock) event has the same timestamp as the login(unlock).

getting closer..


Sometimes Windows simply doesn't log event 538.

Microsoft's comments: This event does not necessarily indicate the time that a user has stopped using a system. For example, if the computer is shut down or loses network connectivity it may not record a logoff event at all."

share|improve this answer

If you authenticate to a domain controller, you can check the successful audits in the security log file. Every time you successfully log in, it will be recorded (unsuccessful log ins will be recorded also).

share|improve this answer

There are a number of ways to get these, depending on your programming proficiency.

  • You can subscribe to SENS service with some COM coding
  • You can register a window for session change notification with WTSRegisterSessionNotification
  • Some of these may exist in the Microsoft.Win32.SystemEvents namespace for .NET

If any of these are a route you want to take, you may find the following helpful

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.