In Windows 7, How to query times, when the computer was locked?
Event ID 4800 should correspond to The workstation was locked, and similarly Event ID 4801 should correspond to The workstation was unlocked.
If you don't see them in the Event Viewer, for recording future events try opening the Local Group Policy Editor (Start / Run / gpedit.msc
), navigating to:
Computer Configuration / Windows Settings / Security Settings / Advanced Audit Policy Configuration / System Audit Policies - Local Group Policy Object / Logon/Logoff / Audit Other Logon/Logoff Events
and enabling the checkboxes for Success and Failure:
I found events corresponding to locking and unlocking in my Windows 7 Security Event log
4634 Logoff with (WinKey +L)
4624 and 4672 unlocking.