Computer lock screen12/16/2023 In Windows 10, version 1703, you can use the Personalization CSP settings to set lock screen and desktop background images. If you remove | findstr "Date" from any of the above commands, you'll instead get the full details of the logs, rather than just the times, and you could use something else to filter the users you want to see using the "Account Name:" in the Details field.In Windows 10, version 1607, the lock screen background does not display if you disable the Animate windows when minimizing and maximizing setting in This PC > Properties > Advanced system settings > Performance settings > Visual Effects, or if you enable the Group Policy setting Computer Configuration > Administrative Templates > Windows Components > Desktop Windows Manager > Do not allow windows animations. Unfortunately these logs don't store the current user in the User field, oddly, instead it's stored in the details, so there's no easy way to filter them using the simple query it offers. The above commands however do not filter by the current user, that would give you logs from all local users. To view both lock and unlock times: wevtutil qe Security /q:"*]" /f:Text | findstr "Date" To view just unlocked times: wevtutil qe Security /q:"*]" /f:Text | findstr "Date" To view just locked times: wevtutil qe Security /q:"*]" /f:Text | findstr "Date" Once that's enabled those events will start being logged, if it was disabled you won't have any events logged yet. I'm new so SE is blocking my images, hopefully you can access it below. open up secpol.msc go to Advanced Audit Policies on Local Computer, System Audit Policies, Logon/Logoff, in there configure "Audit Other Logon/Logoff Events" so Successes are logged. How do I simply grab the date/time/timestamp for the last time the current user locked or unlocked (either is fine, but both combined is optimal) the machine?įirst you'll want to be sure you're logging those events. Isn't there a single, well-defined "Windows API" that you can execute on the command line to get basic stats/information like that out from Windows without needing to know everything about its internals? right? I simply don't understand why this is even a problem. There's got to be a better, proper way to simply get the last time that the machine was locked/unlocked. I truly don't know what to make of this, and the Microsoft support pages feel like I'm reading text written by literal aliens from another world. That command, and the entire "event log", seems fundamentally unreliable and isn't even consistent. At this point, it feels like I've tried everything. I keep scratching my head about the nonsensical and ever varying output I get from this command. I've executed a million different wevtutil commands at this point and endlessly read cryptic help page/webpages as well as old SE questions. Then I just get nonsensical output such as: Event ID: 7001 If I use: wevtutil qe System /rd /f:Text | findstr "7001 7002" They seem to refer to the login/logout times. They don't update when I lock/unlock the machine and re-run the command. Those numbers are supposed to be the "last locked" or "last unlocked" events. I previously got this command on Stack Exchange: wevtutil qe System /rd /f:Text | findstr "4800 4801"
0 Comments
Leave a Reply.AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |