How do I retrieve a list of logon/logoff/lock/unlock times in Windows?

Question

Is there any way to get a list of times that a user logged on, logged off, locked, or unlocked their computer for the past week or so without adding a service to track it as it happens? Does Windows even keep that information for that long?

Answer 1

Check EventLog. I know that logon/logoff times are written there.

For Lock/unlock, I am not sure.

Answer 2

If you check the event log and you can look under audits for the username. It treats a logon/unlock as an authentication. There may be more in the event that you can trace it back to a spefic logon/logoff event (lock, or an actual logoff, etc).

Answer 3

You might try WMI for Win32_UserAccount activity