如何在Windows中检索登录/注销/锁定/解锁时间的列表？

Question

Is there any way to get a list of times that a user logged on, logged off, locked, or unlocked their computer for the past week or so without adding a service to track it as it happens? Does Windows even keep that information for that long?

Answer 1

Check EventLog. I know that logon/logoff times are written there.

For Lock/unlock, I am not sure.

Answer 2

If you check the event log and you can look under audits for the username. It treats a logon/unlock as an authentication. There may be more in the event that you can trace it back to a spefic logon/logoff event (lock, or an actual logoff, etc).

Answer 3

您可以尝试使用WMI进行Win32_UserAccount活动