Let me preface by saying I am extremely forgetful.

I would like to have a log when I login, logout, lock and unlock my workstation.

(in my case so i can track the nunmber of hours i spend at the PC)

the EventViewer is alomst good enought. The Security view show Logon/Logoff events. I just need to know the Lock/Unlock events also.

or a method to call a script on those events so i can do the logging myself.

8 Answers 8


You know, there's a cheap little bluetooth device out there that might help you.

You plug it in to your USB port and keep the "dongle" in your pocket.

When you walk away from your PC (say 6 feet or so) the computer automatically locks. When you come back within range it automatically unlocks.


I finally found the one I have. Its a PC Defender Wireless Screen Lock. Not sure if they sell them anymore but I've seen plenty of them out there at places like Fry's Electronics, etc. Here's a link to show you what one looks like:


On that note... there are also programs out there such as Blue Lock 1.92 and others which can tie in to the Bluetooth on your phone and perform certain actions (usually lock the screen) when you walk away from your PC (taking your phone with you).

Another solution would be to use your webcam to take periodic screenshots, say every 5min. Then just count the shots that have your face in them. Microsoft has a Power Toy that does this. Also doubles as a security camera. ;-)


Unfortunately there is no "lock" workstation event -- unlocking (with the correct audit settings turned on can trigger a pair of 528/538 events with a type of '7'.

A better idea might be to look at the various tools out there that can traack machine usage for billing purposes. They can usually give you a list of what application had focus during what time frame.

We use Spector 360 to do this on a network wide scale.


For anyone who likes to know how to do this in Windows 7 (like me): Open Local Security Policy (can be found by pressing the Windows key once and typing "Local Security Policy") => Advanced Audit Policy Configuration => ... => Logon/Logoff => Audit Other Logon/Logoff Events => double click and mark all the check boxes => save

Screenshot: Audit Other Logon/Logoff Events

Now you get the events in the Event Viewer under Windows Logs => Security (Event IDs 4800 and 4801)


There is a "logon type" for "Unlock Workstation" (type 7) that will get logged into the event log. I'm not sure this going to give you want you want, though.

The easiest way to do what you want would be to run a user-land program that you interacted with to keep time records.

You could develop a GINA library that log your own events when a lock workstation or unlock workstation occured, since both of those events have callbacks into the GINA. (In Vista, GINA was replaced with Credential Providers and it's not immediately clear to me if they get a callback when a lock workstation occurs or not.)


We have a login and logoff script that runs via group policy that logs to a file each time someone logs in or off - that might help? Login file contains the following (set up the \server01\audit$ share first!)

@echo %username%,%date%,%time%,%computername%,%clientname% >>\\server01\audit$\%username%login.txt

i've found a partial answer..

the local secturity settings Auditpolicy..

i have turned on "Audit account logon events"

i know get logon/logoff events when i lock the PC.

however teh logoff (ie lock) event has the same timestamp as the login(unlock).

getting closer..



Sometimes Windows simply doesn't log event 538.

Microsoft's comments: This event does not necessarily indicate the time that a user has stopped using a system. For example, if the computer is shut down or loses network connectivity it may not record a logoff event at all."


If you authenticate to a domain controller, you can check the successful audits in the security log file. Every time you successfully log in, it will be recorded (unsuccessful log ins will be recorded also).


There are a number of ways to get these, depending on your programming proficiency.

  • You can subscribe to SENS service with some COM coding
  • You can register a window for session change notification with WTSRegisterSessionNotification
  • Some of these may exist in the Microsoft.Win32.SystemEvents namespace for .NET

If any of these are a route you want to take, you may find the following helpful

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.